source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  Version 1.9.
   4  *  RPC Pipe client / server routines
   5  *  Copyright (C) Andrew Tridgell              1992-1998
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   7  *  Copyright (C) Paul Ashton                  1997-1998.
   8  *  Copyright (C) Jeremy Allison                    1999.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 /*  this module apparently provides an implementation of DCE/RPC over a
  26  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  27  *  documentation are available (in on-line form) from the X-Open group.
  28  *
  29  *  this module should provide a level of abstraction between SMB
  30  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  31  *  data copies, and network traffic.
  32  *
  33  *  in this version, which takes a "let's learn what's going on and
  34  *  get something running" approach, there is additional network
  35  *  traffic generated, but the code should be easier to understand...
  36  *
  37  *  ... if you read the docs.  or stare at packets for weeks on end.
  38  *
  39  */
  40
  41 #include "includes.h"
  42
  43 extern int DEBUGLEVEL;
  44
  45 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  46 {
  47     unsigned char *hash = p->ntlmssp_hash;
  48     unsigned char index_i = hash[256];
  49     unsigned char index_j = hash[257];
  50     int ind;
  51
  52     for( ind = 0; ind < len; ind++) {
  53         unsigned char tc;
  54         unsigned char t;
  55
  56         index_i++;
  57         index_j += hash[index_i];
  58
  59         tc = hash[index_i];
  60         hash[index_i] = hash[index_j];
  61         hash[index_j] = tc;
  62
  63         t = hash[index_i] + hash[index_j];
  64         data[ind] = data[ind] ^ hash[t];
  65     }
  66
  67     hash[256] = index_i;
  68     hash[257] = index_j;
  69 }
  70
  71 /*******************************************************************
  72  Generate the next PDU to be returned from the data in p->rdata.
  73  We cheat here as this function doesn't handle the special auth
  74  footers of the authenticated bind response reply.
  75  ********************************************************************/
  76
  77 BOOL create_next_pdu(pipes_struct *p)
  78 {
  79         RPC_HDR_RESP hdr_resp;
  80         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
  81         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
  82         uint32 data_len;
  83         uint32 data_space_available;
  84         uint32 data_len_left;
  85         prs_struct outgoing_pdu;
  86         char *data;
  87         char *data_from;
  88         uint32 data_pos;
  89
  90         /*
  91          * If we're in the fault state, keep returning fault PDU's until
  92          * the pipe gets closed. JRA.
  93          */
  94
  95         if(p->fault_state) {
  96                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
  97                 return True;
  98         }
  99
 100         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 101
 102         /* Change the incoming request header to a response. */
 103         p->hdr.pkt_type = RPC_RESPONSE;
 104
 105         /* Set up rpc header flags. */
 106         if (p->out_data.data_sent_length == 0)
 107                 p->hdr.flags = RPC_FLG_FIRST;
 108         else
 109                 p->hdr.flags = 0;
 110
 111         /*
 112          * Work out how much we can fit in a single PDU.
 113          */
 114
 115         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 116         if(p->ntlmssp_auth_validated)
 117                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 118
 119         /*
 120          * The amount we send is the minimum of the available
 121          * space and the amount left to send.
 122          */
 123
 124         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 125
 126         /*
 127          * Ensure there really is data left to send.
 128          */
 129
 130         if(!data_len_left) {
 131                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 132                 return False;
 133         }
 134
 135         data_len = MIN(data_len_left, data_space_available);
 136
 137         /*
 138          * Set up the alloc hint. This should be the data left to
 139          * send.
 140          */
 141
 142         hdr_resp.alloc_hint = data_len_left;
 143
 144         /*
 145          * Set up the header lengths.
 146          */
 147
 148         if (p->ntlmssp_auth_validated) {
 149                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 150                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 151                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 152         } else {
 153                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 154                 p->hdr.auth_len = 0;
 155         }
 156
 157         /*
 158          * Work out if this PDU will be the last.
 159          */
 160
 161         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 162                 p->hdr.flags |= RPC_FLG_LAST;
 163
 164         /*
 165          * Init the parse struct to point at the outgoing
 166          * data.
 167          */
 168
 169         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 170         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 171
 172         /* Store the header in the data stream. */
 173         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 174                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 175                 prs_mem_free(&outgoing_pdu);
 176                 return False;
 177         }
 178
 179         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 180                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 181                 prs_mem_free(&outgoing_pdu);
 182                 return False;
 183         }
 184
 185         /* Store the current offset. */
 186         data_pos = prs_offset(&outgoing_pdu);
 187
 188         /* Copy the data into the PDU. */
 189         data_from = prs_data_p(&p->out_data.rdata) + p->out_data.data_sent_length;
 190
 191         if(!prs_append_data(&outgoing_pdu, data_from, data_len)) {
 192                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 193                 prs_mem_free(&outgoing_pdu);
 194                 return False;
 195         }
 196
 197         /*
 198          * Set data to point to where we copied the data into.
 199          */
 200
 201         data = prs_data_p(&outgoing_pdu) + data_pos;
 202
 203         if (p->hdr.auth_len > 0) {
 204                 uint32 crc32 = 0;
 205
 206                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 207                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 208
 209                 if (auth_seal) {
 210                         crc32 = crc32_calc_buffer(data, data_len);
 211                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 212                 }
 213
 214                 if (auth_seal || auth_verify) {
 215                         RPC_HDR_AUTH auth_info;
 216
 217                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL,
 218                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 219                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 220                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 221                                 prs_mem_free(&outgoing_pdu);
 222                                 return False;
 223                         }
 224                 }
 225
 226                 if (auth_verify) {
 227                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 228                         char *auth_data = prs_data_p(&outgoing_pdu);
 229
 230                         p->ntlmssp_seq_num++;
 231                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 232                                         crc32, p->ntlmssp_seq_num++);
 233                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 234                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 235                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 236                                 prs_mem_free(&outgoing_pdu);
 237                                 return False;
 238                         }
 239                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 240                 }
 241         }
 242
 243         /*
 244          * Setup the counts for this PDU.
 245          */
 246
 247         p->out_data.data_sent_length += data_len;
 248         p->out_data.current_pdu_len = p->hdr.frag_len;
 249         p->out_data.current_pdu_sent = 0;
 250
 251         prs_mem_free(&outgoing_pdu);
 252         return True;
 253 }
 254
 255 /*******************************************************************
 256  Process an NTLMSSP authentication response.
 257  If this function succeeds, the user has been authenticated
 258  and their domain, name and calling workstation stored in
 259  the pipe struct.
 260  The initial challenge is stored in p->challenge.
 261  *******************************************************************/
 262
 263 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 264 {
 265         uchar lm_owf[24];
 266         uchar nt_owf[128];
 267         int nt_pw_len;
 268         int lm_pw_len;
 269         fstring user_name;
 270         fstring pipe_user_name;
 271         fstring domain;
 272         fstring wks;
 273         BOOL guest_user = False;
 274         SAM_ACCOUNT *sampass = NULL;
 275         uchar null_smb_passwd[16];
 276         uchar *smb_passwd_ptr = NULL;
 277
 278         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 279
 280         memset(p->user_name, '\0', sizeof(p->user_name));
 281         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 282         memset(p->domain, '\0', sizeof(p->domain));
 283         memset(p->wks, '\0', sizeof(p->wks));
 284
 285         /* Set up for non-authenticated user. */
 286         delete_nt_token(&p->pipe_user.nt_user_token);
 287         p->pipe_user.ngroups = 0;
 288         safe_free( p->pipe_user.groups);
 289
 290         /*
 291          * Setup an empty password for a guest user.
 292          */
 293
 294         memset(null_smb_passwd,0,16);
 295
 296         /*
 297          * We always negotiate UNICODE.
 298          */
 299
 300         if (p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_UNICODE) {
 301                 rpcstr_pull(user_name, ntlmssp_resp->user, sizeof(fstring), ntlmssp_resp->hdr_usr.str_str_len*2, 0 );
 302                 rpcstr_pull(domain, ntlmssp_resp->domain, sizeof(fstring), ntlmssp_resp->hdr_domain.str_str_len*2, 0);
 303                 rpcstr_pull(wks, ntlmssp_resp->wks, sizeof(fstring), ntlmssp_resp->hdr_wks.str_str_len*2, 0);
 304         } else {
 305                 fstrcpy(user_name, ntlmssp_resp->user);
 306                 fstrcpy(domain, ntlmssp_resp->domain);
 307                 fstrcpy(wks, ntlmssp_resp->wks);
 308         }
 309
 310         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 311
 312         nt_pw_len = MIN(sizeof(nt_owf), ntlmssp_resp->hdr_nt_resp.str_str_len);
 313         lm_pw_len = MIN(sizeof(lm_owf), ntlmssp_resp->hdr_lm_resp.str_str_len);
 314
 315         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 316         memcpy(nt_owf, ntlmssp_resp->nt_resp, nt_pw_len);
 317
 318 #ifdef DEBUG_PASSWORD
 319         DEBUG(100,("lm, nt owfs, chal\n"));
 320         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 321         dump_data(100, (char *)nt_owf, nt_pw_len);
 322         dump_data(100, (char *)p->challenge, 8);
 323 #endif
 324
 325         /*
 326          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 327          */
 328
 329         if((strlen(user_name) == 0) &&
 330            (ntlmssp_resp->hdr_nt_resp.str_str_len==0))
 331           {
 332                 guest_user = True;
 333
 334         fstrcpy(pipe_user_name, lp_guestaccount(-1));
 335                 DEBUG(100,("Null user in NTLMSSP verification. Using guest = %s\n", pipe_user_name));
 336
 337                 smb_passwd_ptr = null_smb_passwd;
 338
 339         } else {
 340
 341                 /*
 342                  * Pass the user through the NT -> unix user mapping
 343                  * function.
 344                  */
 345
 346                 fstrcpy(pipe_user_name, user_name);
 347                 (void)map_username(pipe_user_name);
 348
 349                 /*
 350                  * Do the length checking only if user is not NULL.
 351                  */
 352
 353                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 354                         return False;
 355                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 356                         return False;
 357                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 358                         return False;
 359                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 360                         return False;
 361                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 362                         return False;
 363
 364         }
 365
 366         if(!guest_user) {
 367
 368                 become_root();
 369
 370                 p->ntlmssp_auth_validated =
 371                         NT_STATUS_IS_OK(pass_check_smb_with_chal(pipe_user_name, domain,
 372                                                                  (uchar*)p->challenge,
 373                                                                  lm_owf, lm_pw_len,
 374                                                                  nt_owf, nt_pw_len));
 375                 if (!p->ntlmssp_auth_validated) {
 376                         DEBUG(1,("api_pipe_ntlmssp_verify: User %s\\%s from machine %s \
 377 failed authentication on named pipe %s.\n", domain, pipe_user_name, wks, p->name ));
 378                         unbecome_root();
 379                         return False;
 380                 }
 381
 382                 pdb_init_sam(&sampass);
 383
 384                 if(!pdb_getsampwnam(sampass, pipe_user_name)) {
 385                         DEBUG(1,("api_pipe_ntlmssp_verify: Cannot find user %s in smb passwd database.\n",
 386                                 pipe_user_name));
 387                         pdb_free_sam(sampass);
 388                         unbecome_root();
 389                         return False;
 390                 }
 391
 392                 unbecome_root();
 393
 394                 /* Quit if the account was disabled. */
 395                 if((pdb_get_acct_ctrl(sampass) & ACB_DISABLED) || !pdb_get_lanman_passwd(sampass)) {
 396                         DEBUG(1,("Account for user '%s' was disabled.\n", pipe_user_name));
 397                         pdb_free_sam(sampass);
 398                         return False;
 399                }
 400
 401                 if(!pdb_get_nt_passwd(sampass)) {
 402                         DEBUG(1,("Account for user '%s' has no NT password hash.\n", pipe_user_name));
 403                         pdb_free_sam(sampass);
 404                         return False;
 405                 }
 406
 407                 smb_passwd_ptr = pdb_get_lanman_passwd(sampass);
 408         }
 409
 410         /*
 411          * Set up the sign/seal data.
 412          */
 413
 414         {
 415                 uchar p24[24];
 416                 NTLMSSPOWFencrypt(smb_passwd_ptr, lm_owf, p24);
 417                 {
 418                         unsigned char j = 0;
 419                         int ind;
 420
 421                         unsigned char k2[8];
 422
 423                         memcpy(k2, p24, 5);
 424                         k2[5] = 0xe5;
 425                         k2[6] = 0x38;
 426                         k2[7] = 0xb0;
 427
 428                         for (ind = 0; ind < 256; ind++)
 429                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 430
 431                         for( ind = 0; ind < 256; ind++) {
 432                                 unsigned char tc;
 433
 434                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 435
 436                                 tc = p->ntlmssp_hash[ind];
 437                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 438                                 p->ntlmssp_hash[j] = tc;
 439                         }
 440
 441                         p->ntlmssp_hash[256] = 0;
 442                         p->ntlmssp_hash[257] = 0;
 443                 }
 444 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 445                 p->ntlmssp_seq_num = 0;
 446
 447         }
 448
 449         fstrcpy(p->user_name, user_name);
 450         fstrcpy(p->pipe_user_name, pipe_user_name);
 451         fstrcpy(p->domain, domain);
 452         fstrcpy(p->wks, wks);
 453
 454         /*
 455          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 456          */
 457
 458         p->pipe_user.uid = pdb_get_uid(sampass);
 459         p->pipe_user.gid = pdb_get_gid(sampass);
 460
 461         /* Set up pipe user group membership. */
 462         initialise_groups(pipe_user_name, p->pipe_user.uid, p->pipe_user.gid);
 463         get_current_groups( &p->pipe_user.ngroups, &p->pipe_user.groups);
 464
 465         /* Create an NT_USER_TOKEN struct for this user. */
 466         p->pipe_user.nt_user_token = create_nt_token(p->pipe_user.uid,p->pipe_user.gid,
 467                                                 p->pipe_user.ngroups, p->pipe_user.groups,
 468                                                 guest_user);
 469
 470         p->ntlmssp_auth_validated = True;
 471
 472         pdb_free_sam(sampass);
 473         return True;
 474 }
 475
 476 /*******************************************************************
 477  The switch table for the pipe names and the functions to handle them.
 478  *******************************************************************/
 479
 480 struct api_cmd
 481 {
 482   char * pipe_clnt_name;
 483   char * pipe_srv_name;
 484   BOOL (*fn) (pipes_struct *);
 485 };
 486
 487 static struct api_cmd api_fd_commands[] =
 488 {
 489     { "lsarpc",   "lsass",   api_ntlsa_rpc },
 490     { "samr",     "lsass",   api_samr_rpc },
 491     { "srvsvc",   "ntsvcs",  api_srvsvc_rpc },
 492     { "wkssvc",   "ntsvcs",  api_wkssvc_rpc },
 493     { "NETLOGON", "lsass",   api_netlog_rpc },
 494     { "winreg",   "winreg",  api_reg_rpc },
 495     { "spoolss",  "spoolss", api_spoolss_rpc },
 496     { "netdfs",   "netdfs" , api_netdfs_rpc },
 497     { NULL,       NULL,      NULL }
 498 };
 499
 500 /*******************************************************************
 501  This is the client reply to our challenge for an authenticated
 502  bind request. The challenge we sent is in p->challenge.
 503 *******************************************************************/
 504
 505 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 506 {
 507         RPC_HDR_AUTHA autha_info;
 508         RPC_AUTH_VERIFIER auth_verifier;
 509         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 510
 511         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 512
 513         if (p->hdr.auth_len == 0) {
 514                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 515                 return False;
 516         }
 517
 518         /*
 519          * Decode the authentication verifier response.
 520          */
 521
 522         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 523                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 524                 return False;
 525         }
 526
 527         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != NTLMSSP_AUTH_LEVEL) {
 528                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 529                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 530                 return False;
 531         }
 532
 533         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 534                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 535                 return False;
 536         }
 537
 538         /*
 539          * Ensure this is a NTLMSSP_AUTH packet type.
 540          */
 541
 542         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 543                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 544                 return False;
 545         }
 546
 547         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 548                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 549                 return False;
 550         }
 551
 552         /*
 553          * The following call actually checks the challenge/response data.
 554          * for correctness against the given DOMAIN\user name.
 555          */
 556
 557         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 558                 return False;
 559
 560         p->pipe_bound = True
 561 ;
 562         return True;
 563 }
 564
 565 /*******************************************************************
 566  Marshall a bind_nak pdu.
 567 *******************************************************************/
 568
 569 static BOOL setup_bind_nak(pipes_struct *p)
 570 {
 571         prs_struct outgoing_rpc;
 572         RPC_HDR nak_hdr;
 573         uint16 zero = 0;
 574
 575         /* Free any memory in the current return data buffer. */
 576         prs_mem_free(&p->out_data.rdata);
 577
 578         /*
 579          * Marshall directly into the outgoing PDU space. We
 580          * must do this as we need to set to the bind response
 581          * header and are never sending more than one PDU here.
 582          */
 583
 584         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 585         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 586
 587
 588         /*
 589          * Initialize a bind_nak header.
 590          */
 591
 592         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 593             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 594
 595         /*
 596          * Marshall the header into the outgoing PDU.
 597          */
 598
 599         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 600                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 601                 prs_mem_free(&outgoing_rpc);
 602                 return False;
 603         }
 604
 605         /*
 606          * Now add the reject reason.
 607          */
 608
 609         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 610                 prs_mem_free(&outgoing_rpc);
 611         return False;
 612         }
 613
 614         p->out_data.data_sent_length = 0;
 615         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 616         p->out_data.current_pdu_sent = 0;
 617
 618         p->pipe_bound = False;
 619
 620         return True;
 621 }
 622
 623 /*******************************************************************
 624  Marshall a fault pdu.
 625 *******************************************************************/
 626
 627 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 628 {
 629         prs_struct outgoing_pdu;
 630         RPC_HDR fault_hdr;
 631         RPC_HDR_RESP hdr_resp;
 632         RPC_HDR_FAULT fault_resp;
 633
 634         /* Free any memory in the current return data buffer. */
 635         prs_mem_free(&p->out_data.rdata);
 636
 637         /*
 638          * Marshall directly into the outgoing PDU space. We
 639          * must do this as we need to set to the bind response
 640          * header and are never sending more than one PDU here.
 641          */
 642
 643         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 644         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 645
 646         /*
 647          * Initialize a fault header.
 648          */
 649
 650         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 651             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 652
 653         /*
 654          * Initialize the HDR_RESP and FAULT parts of the PDU.
 655          */
 656
 657         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 658
 659         fault_resp.status = status;
 660         fault_resp.reserved = 0;
 661
 662         /*
 663          * Marshall the header into the outgoing PDU.
 664          */
 665
 666         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 667                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 668                 prs_mem_free(&outgoing_pdu);
 669                 return False;
 670         }
 671
 672         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 673                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 674                 prs_mem_free(&outgoing_pdu);
 675                 return False;
 676         }
 677
 678         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 679                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 680                 prs_mem_free(&outgoing_pdu);
 681                 return False;
 682         }
 683
 684         p->out_data.data_sent_length = 0;
 685         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 686         p->out_data.current_pdu_sent = 0;
 687
 688         prs_mem_free(&outgoing_pdu);
 689         return True;
 690 }
 691
 692 /*******************************************************************
 693  Ensure a bind request has the correct abstract & transfer interface.
 694  Used to reject unknown binds from Win2k.
 695 *******************************************************************/
 696
 697 BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract,
 698                                         RPC_IFACE* transfer)
 699 {
 700         extern struct pipe_id_info pipe_names[];
 701         int i=0;
 702         fstring pname;
 703         fstrcpy(pname,"\\PIPE\\");
 704         fstrcat(pname,pipe_name);
 705
 706         for(i=0;pipe_names[i].client_pipe; i++) {
 707                 if(strequal(pipe_names[i].client_pipe, pname))
 708                         break;
 709         }
 710
 711         if(pipe_names[i].client_pipe == NULL)
 712                 return False;
 713
 714         /* check the abstract interface */
 715         if((abstract->version != pipe_names[i].abstr_syntax.version) ||
 716                 (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid,
 717                         sizeof(RPC_UUID)) != 0))
 718                 return False;
 719
 720         /* check the transfer interface */
 721         if((transfer->version != pipe_names[i].trans_syntax.version) ||
 722                 (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid,
 723                         sizeof(RPC_UUID)) != 0))
 724                 return False;
 725
 726         return True;
 727 }
 728
 729 /*******************************************************************
 730  Respond to a pipe bind request.
 731 *******************************************************************/
 732
 733 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 734 {
 735         RPC_HDR_BA hdr_ba;
 736         RPC_HDR_RB hdr_rb;
 737         RPC_HDR_AUTH auth_info;
 738         uint16 assoc_gid;
 739         fstring ack_pipe_name;
 740         prs_struct out_hdr_ba;
 741         prs_struct out_auth;
 742         prs_struct outgoing_rpc;
 743         int i = 0;
 744         int auth_len = 0;
 745         enum RPC_PKT_TYPE reply_pkt_type;
 746
 747         p->ntlmssp_auth_requested = False;
 748
 749         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 750
 751         /*
 752          * Try and find the correct pipe name to ensure
 753          * that this is a pipe name we support.
 754          */
 755
 756         for (i = 0; api_fd_commands[i].pipe_clnt_name; i++) {
 757                 if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
 758                     api_fd_commands[i].fn != NULL) {
 759                         DEBUG(3,("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 760                                    api_fd_commands[i].pipe_clnt_name,
 761                                    api_fd_commands[i].pipe_srv_name));
 762                         fstrcpy(p->pipe_srv_name, api_fd_commands[i].pipe_srv_name);
 763                         break;
 764                 }
 765         }
 766
 767         if (api_fd_commands[i].fn == NULL) {
 768                 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 769                         p->name ));
 770                 if(!setup_bind_nak(p))
 771                         return False;
 772                 return True;
 773         }
 774
 775         /* decode the bind request */
 776         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 777                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 778                 return False;
 779         }
 780
 781         /*
 782          * Check if this is an authenticated request.
 783          */
 784
 785         if (p->hdr.auth_len != 0) {
 786                 RPC_AUTH_VERIFIER auth_verifier;
 787                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 788
 789                 /*
 790                  * Decode the authentication verifier.
 791                  */
 792
 793                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 794                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 795                         return False;
 796                 }
 797
 798                 /*
 799                  * We only support NTLMSSP_AUTH_TYPE requests.
 800                  */
 801
 802                 if(auth_info.auth_type != NTLMSSP_AUTH_TYPE) {
 803                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 804                                 auth_info.auth_type ));
 805                         return False;
 806                 }
 807
 808                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 809                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 810                         return False;
 811                 }
 812
 813                 if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 814                         DEBUG(0,("api_pipe_bind_req: auth_verifier.signature != NTLMSSP\n"));
 815                         return False;
 816                 }
 817
 818                 if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 819                         DEBUG(0,("api_pipe_bind_req: auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 820                                 auth_verifier.msg_type));
 821                         return False;
 822                 }
 823
 824                 if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 825                         DEBUG(0,("api_pipe_bind_req: Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 826                         return False;
 827                 }
 828
 829                 p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 830                 p->ntlmssp_auth_requested = True;
 831         }
 832
 833         switch(p->hdr.pkt_type) {
 834                 case RPC_BIND:
 835                         /* name has to be \PIPE\xxxxx */
 836                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 837                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 838                         reply_pkt_type = RPC_BINDACK;
 839                         break;
 840                 case RPC_ALTCONT:
 841                         /* secondary address CAN be NULL
 842                          * as the specs say it's ignored.
 843                          * It MUST NULL to have the spoolss working.
 844                          */
 845                         fstrcpy(ack_pipe_name,"");
 846                         reply_pkt_type = RPC_ALTCONTRESP;
 847                         break;
 848                 default:
 849                         return False;
 850         }
 851
 852         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 853
 854         /*
 855          * Marshall directly into the outgoing PDU space. We
 856          * must do this as we need to set to the bind response
 857          * header and are never sending more than one PDU here.
 858          */
 859
 860         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 861         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 862
 863         /*
 864          * Setup the memory to marshall the ba header, and the
 865          * auth footers.
 866          */
 867
 868         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
 869                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
 870                 prs_mem_free(&outgoing_rpc);
 871                 return False;
 872         }
 873
 874         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
 875                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
 876                 prs_mem_free(&outgoing_rpc);
 877                 prs_mem_free(&out_hdr_ba);
 878                 return False;
 879         }
 880
 881         if (p->ntlmssp_auth_requested)
 882                 assoc_gid = 0x7a77;
 883         else
 884                 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
 885
 886         /*
 887          * Create the bind response struct.
 888          */
 889
 890         /* If the requested abstract synt uuid doesn't match our client pipe,
 891                 reject the bind_ack & set the transfer interface synt to all 0's,
 892                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 893                 unknown to NT4)
 894                 Needed when adding entries to a DACL from NT5 - SK */
 895
 896         if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) {
 897                 init_rpc_hdr_ba(&hdr_ba,
 898                         MAX_PDU_FRAG_LEN,
 899                         MAX_PDU_FRAG_LEN,
 900                         assoc_gid,
 901                         ack_pipe_name,
 902                         0x1, 0x0, 0x0,
 903                         &hdr_rb.transfer);
 904         } else {
 905                 RPC_IFACE null_interface;
 906                 ZERO_STRUCT(null_interface);
 907                 /* Rejection reason: abstract syntax not supported */
 908                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
 909                                         MAX_PDU_FRAG_LEN, assoc_gid,
 910                                         ack_pipe_name, 0x1, 0x2, 0x1,
 911                                         &null_interface);
 912         }
 913
 914         /*
 915          * and marshall it.
 916          */
 917
 918         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
 919                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
 920                 goto err_exit;
 921         }
 922
 923         /*
 924          * Now the authentication.
 925          */
 926
 927         if (p->ntlmssp_auth_requested) {
 928                 RPC_AUTH_VERIFIER auth_verifier;
 929                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
 930
 931                 generate_random_buffer(p->challenge, 8, False);
 932
 933                 /*** Authentication info ***/
 934
 935                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
 936                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
 937                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
 938                         goto err_exit;
 939                 }
 940
 941                 /*** NTLMSSP verifier ***/
 942
 943                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
 944                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
 945                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
 946                         goto err_exit;
 947                 }
 948
 949                 /* NTLMSSP challenge ***/
 950
 951                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
 952                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
 953                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
 954                         goto err_exit;
 955                 }
 956
 957                 /* Auth len in the rpc header doesn't include auth_header. */
 958                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
 959         }
 960
 961         /*
 962          * Create the header, now we know the length.
 963          */
 964
 965         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
 966                         p->hdr.call_id,
 967                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
 968                         auth_len);
 969
 970         /*
 971          * Marshall the header into the outgoing PDU.
 972          */
 973
 974         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
 975                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
 976                 goto err_exit;
 977         }
 978
 979         /*
 980          * Now add the RPC_HDR_BA and any auth needed.
 981          */
 982
 983         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
 984                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
 985                 goto err_exit;
 986         }
 987
 988         if(p->ntlmssp_auth_requested && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
 989                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
 990                 goto err_exit;
 991         }
 992
 993         if(!p->ntlmssp_auth_requested)
 994                 p->pipe_bound = True;
 995
 996         /*
 997          * Setup the lengths for the initial reply.
 998          */
 999
1000         p->out_data.data_sent_length = 0;
1001         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1002         p->out_data.current_pdu_sent = 0;
1003
1004         prs_mem_free(&out_hdr_ba);
1005         prs_mem_free(&out_auth);
1006
1007         return True;
1008
1009   err_exit:
1010
1011         prs_mem_free(&outgoing_rpc);
1012         prs_mem_free(&out_hdr_ba);
1013         prs_mem_free(&out_auth);
1014         return False;
1015 }
1016
1017 /****************************************************************************
1018  Deal with sign & seal processing on an RPC request.
1019 ****************************************************************************/
1020
1021 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1022 {
1023         /*
1024          * We always negotiate the following two bits....
1025          */
1026         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
1027         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
1028         int data_len;
1029         int auth_len;
1030         uint32 old_offset;
1031         uint32 crc32 = 0;
1032
1033         auth_len = p->hdr.auth_len;
1034
1035         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1036                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1037                 return False;
1038         }
1039
1040         /*
1041          * The following is that length of the data we must verify or unseal.
1042          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1043          * preceeding the auth_data.
1044          */
1045
1046         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1047                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1048
1049         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1050                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1051
1052         if (auth_seal) {
1053                 /*
1054                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1055                  * has already been consumed.
1056                  */
1057                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1058                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1059                 crc32 = crc32_calc_buffer(data, data_len);
1060         }
1061
1062         old_offset = prs_offset(rpc_in);
1063
1064         if (auth_seal || auth_verify) {
1065                 RPC_HDR_AUTH auth_info;
1066
1067                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1068                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1069                                 (unsigned int)old_offset + data_len ));
1070                         return False;
1071                 }
1072
1073                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1074                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1075                         return False;
1076                 }
1077         }
1078
1079         if (auth_verify) {
1080                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1081                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1082
1083                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1084
1085                 /*
1086                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1087                  * incoming buffer.
1088                  */
1089                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1090                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1091                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1092                         return False;
1093                 }
1094
1095                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1096                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1097                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1098                         return False;
1099                 }
1100
1101                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1102                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1103                         return False;
1104                 }
1105         }
1106
1107         /*
1108          * Return the current pointer to the data offset.
1109          */
1110
1111         if(!prs_set_offset(rpc_in, old_offset)) {
1112                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1113                         (unsigned int)old_offset ));
1114                 return False;
1115         }
1116
1117         return True;
1118 }
1119
1120 /****************************************************************************
1121  Return a user struct for a pipe user.
1122 ****************************************************************************/
1123
1124 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
1125 {
1126         if (p->ntlmssp_auth_validated) {
1127                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
1128         } else {
1129                 extern struct current_user current_user;
1130                 memcpy(user, &current_user, sizeof(struct current_user));
1131         }
1132
1133         return user;
1134 }
1135
1136 /****************************************************************************
1137  Find the correct RPC function to call for this request.
1138  If the pipe is authenticated then become the correct UNIX user
1139  before doing the call.
1140 ****************************************************************************/
1141
1142 BOOL api_pipe_request(pipes_struct *p)
1143 {
1144         int i = 0;
1145         BOOL ret = False;
1146         BOOL changed_user_id = False;
1147
1148         if (p->ntlmssp_auth_validated) {
1149
1150                 if(!become_authenticated_pipe_user(p)) {
1151                         prs_mem_free(&p->out_data.rdata);
1152                         return False;
1153                 }
1154
1155                 changed_user_id = True;
1156         }
1157
1158         for (i = 0; api_fd_commands[i].pipe_clnt_name; i++) {
1159                 if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
1160                     api_fd_commands[i].fn != NULL) {
1161                         DEBUG(3,("Doing \\PIPE\\%s\n", api_fd_commands[i].pipe_clnt_name));
1162                         set_current_rpc_talloc(p->mem_ctx);
1163                         ret = api_fd_commands[i].fn(p);
1164                         set_current_rpc_talloc(NULL);
1165                 }
1166         }
1167
1168         if(changed_user_id)
1169                 unbecome_authenticated_pipe_user(p);
1170
1171         return ret;
1172 }
1173
1174 /*******************************************************************
1175  Calls the underlying RPC function for a named pipe.
1176  ********************************************************************/
1177
1178 BOOL api_rpcTNP(pipes_struct *p, char *rpc_name,
1179                 struct api_struct *api_rpc_cmds)
1180 {
1181         int fn_num;
1182         fstring name;
1183         uint32 offset1, offset2;
1184
1185         /* interpret the command */
1186         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1187
1188         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
1189         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1190
1191         for (fn_num = 0; api_rpc_cmds[fn_num].name; fn_num++) {
1192                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1193                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1194                         break;
1195                 }
1196         }
1197
1198         if (api_rpc_cmds[fn_num].name == NULL) {
1199                 /*
1200                  * For an unknown RPC just return a fault PDU but
1201                  * return True to allow RPC's on the pipe to continue
1202                  * and not put the pipe into fault state. JRA.
1203                  */
1204                 DEBUG(4, ("unknown\n"));
1205                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
1206                 return True;
1207         }
1208
1209         offset1 = prs_offset(&p->out_data.rdata);
1210
1211         /* do the actual command */
1212         if(!api_rpc_cmds[fn_num].fn(p)) {
1213                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
1214                 prs_mem_free(&p->out_data.rdata);
1215                 return False;
1216         }
1217
1218         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
1219         offset2 = prs_offset(&p->out_data.rdata);
1220         prs_set_offset(&p->out_data.rdata, offset1);
1221         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1222         prs_set_offset(&p->out_data.rdata, offset2);
1223
1224         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1225
1226         /* Check for buffer underflow in rpc parsing */
1227
1228         if ((DEBUGLEVEL >= 10) &&
1229             (p->in_data.data.data_offset != p->in_data.data.buffer_size)) {
1230                 int data_len = p->in_data.data.buffer_size -
1231                         p->in_data.data.data_offset;
1232                 char *data;
1233
1234                 data = malloc(data_len);
1235
1236                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1237                 if (data) {
1238                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data,
1239                                    data_len);
1240                         free(data);
1241                 }
1242
1243         }
1244
1245         return True;
1246 }