source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 /*  this module apparently provides an implementation of DCE/RPC over a
  22  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  23  *  documentation are available (in on-line form) from the X-Open group.
  24  *
  25  *  this module should provide a level of abstraction between SMB
  26  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  27  *  data copies, and network traffic.
  28  *
  29  */
  30
  31 #include "includes.h"
  32
  33 extern struct pipe_id_info pipe_names[];
  34 extern struct current_user current_user;
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_RPC_SRV
  38
  39 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  40 {
  41         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  42
  43         if (a) {
  44                 auth_ntlmssp_end(&a);
  45         }
  46         auth->a_u.auth_ntlmssp_state = NULL;
  47 }
  48
  49 /*******************************************************************
  50  Generate the next PDU to be returned from the data in p->rdata.
  51  Handle NTLMSSP.
  52  ********************************************************************/
  53
  54 static BOOL create_next_pdu_ntlmssp(pipes_struct *p)
  55 {
  56         RPC_HDR_RESP hdr_resp;
  57         uint32 ss_padding_len = 0;
  58         uint32 data_space_available;
  59         uint32 data_len_left;
  60         uint32 data_len;
  61         prs_struct outgoing_pdu;
  62         NTSTATUS status;
  63         DATA_BLOB auth_blob;
  64         RPC_HDR_AUTH auth_info;
  65         uint8 auth_type, auth_level;
  66         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  67
  68         /*
  69          * If we're in the fault state, keep returning fault PDU's until
  70          * the pipe gets closed. JRA.
  71          */
  72
  73         if(p->fault_state) {
  74                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  75                 return True;
  76         }
  77
  78         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  79
  80         /* Change the incoming request header to a response. */
  81         p->hdr.pkt_type = RPC_RESPONSE;
  82
  83         /* Set up rpc header flags. */
  84         if (p->out_data.data_sent_length == 0) {
  85                 p->hdr.flags = RPC_FLG_FIRST;
  86         } else {
  87                 p->hdr.flags = 0;
  88         }
  89
  90         /*
  91          * Work out how much we can fit in a single PDU.
  92          */
  93
  94         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  95
  96         /*
  97          * Ensure there really is data left to send.
  98          */
  99
 100         if(!data_len_left) {
 101                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 102                 return False;
 103         }
 104
 105         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 106                                         RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 107
 108         /*
 109          * The amount we send is the minimum of the available
 110          * space and the amount left to send.
 111          */
 112
 113         data_len = MIN(data_len_left, data_space_available);
 114
 115         /*
 116          * Set up the alloc hint. This should be the data left to
 117          * send.
 118          */
 119
 120         hdr_resp.alloc_hint = data_len_left;
 121
 122         /*
 123          * Work out if this PDU will be the last.
 124          */
 125
 126         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 127                 p->hdr.flags |= RPC_FLG_LAST;
 128                 if (data_len_left % 8) {
 129                         ss_padding_len = 8 - (data_len_left % 8);
 130                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 131                                 ss_padding_len ));
 132                 }
 133         }
 134
 135         /*
 136          * Set up the header lengths.
 137          */
 138
 139         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 140                         data_len + ss_padding_len +
 141                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 142         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 143
 144
 145         /*
 146          * Init the parse struct to point at the outgoing
 147          * data.
 148          */
 149
 150         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 151         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 152
 153         /* Store the header in the data stream. */
 154         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 155                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 156                 prs_mem_free(&outgoing_pdu);
 157                 return False;
 158         }
 159
 160         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 161                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 162                 prs_mem_free(&outgoing_pdu);
 163                 return False;
 164         }
 165
 166         /* Copy the data into the PDU. */
 167
 168         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 169                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 170                 prs_mem_free(&outgoing_pdu);
 171                 return False;
 172         }
 173
 174         /* Copy the sign/seal padding data. */
 175         if (ss_padding_len) {
 176                 char pad[8];
 177
 178                 memset(pad, '\0', 8);
 179                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 180                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 181                                         (unsigned int)ss_padding_len));
 182                         prs_mem_free(&outgoing_pdu);
 183                         return False;
 184                 }
 185         }
 186
 187
 188         /* Now write out the auth header and null blob. */
 189         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 190                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 191         } else {
 192                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 193         }
 194         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 195                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 196         } else {
 197                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 198         }
 199
 200         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 201         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 202                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 203                 prs_mem_free(&outgoing_pdu);
 204                 return False;
 205         }
 206
 207         /* Generate the sign blob. */
 208
 209         switch (p->auth.auth_level) {
 210                 case PIPE_AUTH_LEVEL_PRIVACY:
 211                         /* Data portion is encrypted. */
 212                         status = ntlmssp_seal_packet(a->ntlmssp_state,
 213                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 214                                                         data_len + ss_padding_len,
 215                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 216                                                         (size_t)prs_offset(&outgoing_pdu),
 217                                                         &auth_blob);
 218                         if (!NT_STATUS_IS_OK(status)) {
 219                                 data_blob_free(&auth_blob);
 220                                 prs_mem_free(&outgoing_pdu);
 221                                 return False;
 222                         }
 223                         break;
 224                 case PIPE_AUTH_LEVEL_INTEGRITY:
 225                         /* Data is signed. */
 226                         status = ntlmssp_sign_packet(a->ntlmssp_state,
 227                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 228                                                         data_len + ss_padding_len,
 229                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 230                                                         (size_t)prs_offset(&outgoing_pdu),
 231                                                         &auth_blob);
 232                         if (!NT_STATUS_IS_OK(status)) {
 233                                 data_blob_free(&auth_blob);
 234                                 prs_mem_free(&outgoing_pdu);
 235                                 return False;
 236                         }
 237                         break;
 238                 default:
 239                         prs_mem_free(&outgoing_pdu);
 240                         return False;
 241         }
 242
 243         /* Append the auth blob. */
 244         if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
 245                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 246                                 (unsigned int)NTLMSSP_SIG_SIZE));
 247                 data_blob_free(&auth_blob);
 248                 prs_mem_free(&outgoing_pdu);
 249                 return False;
 250         }
 251
 252         data_blob_free(&auth_blob);
 253
 254         /*
 255          * Setup the counts for this PDU.
 256          */
 257
 258         p->out_data.data_sent_length += data_len;
 259         p->out_data.current_pdu_len = p->hdr.frag_len;
 260         p->out_data.current_pdu_sent = 0;
 261
 262         prs_mem_free(&outgoing_pdu);
 263         return True;
 264 }
 265
 266 /*******************************************************************
 267  Generate the next PDU to be returned from the data in p->rdata.
 268  Return an schannel authenticated fragment.
 269  ********************************************************************/
 270
 271 static BOOL create_next_pdu_schannel(pipes_struct *p)
 272 {
 273         RPC_HDR_RESP hdr_resp;
 274         uint32 ss_padding_len = 0;
 275         uint32 data_len;
 276         uint32 data_space_available;
 277         uint32 data_len_left;
 278         prs_struct outgoing_pdu;
 279         uint32 data_pos;
 280
 281         /*
 282          * If we're in the fault state, keep returning fault PDU's until
 283          * the pipe gets closed. JRA.
 284          */
 285
 286         if(p->fault_state) {
 287                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 288                 return True;
 289         }
 290
 291         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 292
 293         /* Change the incoming request header to a response. */
 294         p->hdr.pkt_type = RPC_RESPONSE;
 295
 296         /* Set up rpc header flags. */
 297         if (p->out_data.data_sent_length == 0) {
 298                 p->hdr.flags = RPC_FLG_FIRST;
 299         } else {
 300                 p->hdr.flags = 0;
 301         }
 302
 303         /*
 304          * Work out how much we can fit in a single PDU.
 305          */
 306
 307         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 308
 309         /*
 310          * Ensure there really is data left to send.
 311          */
 312
 313         if(!data_len_left) {
 314                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 315                 return False;
 316         }
 317
 318         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 319                                         RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 320
 321         /*
 322          * The amount we send is the minimum of the available
 323          * space and the amount left to send.
 324          */
 325
 326         data_len = MIN(data_len_left, data_space_available);
 327
 328         /*
 329          * Set up the alloc hint. This should be the data left to
 330          * send.
 331          */
 332
 333         hdr_resp.alloc_hint = data_len_left;
 334
 335         /*
 336          * Work out if this PDU will be the last.
 337          */
 338
 339         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 340                 p->hdr.flags |= RPC_FLG_LAST;
 341                 if (data_len_left % 8) {
 342                         ss_padding_len = 8 - (data_len_left % 8);
 343                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 344                                 ss_padding_len ));
 345                 }
 346         }
 347
 348         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 349                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 350         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 351
 352         /*
 353          * Init the parse struct to point at the outgoing
 354          * data.
 355          */
 356
 357         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 358         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 359
 360         /* Store the header in the data stream. */
 361         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 362                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 363                 prs_mem_free(&outgoing_pdu);
 364                 return False;
 365         }
 366
 367         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 368                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 369                 prs_mem_free(&outgoing_pdu);
 370                 return False;
 371         }
 372
 373         /* Store the current offset. */
 374         data_pos = prs_offset(&outgoing_pdu);
 375
 376         /* Copy the data into the PDU. */
 377
 378         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 379                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 380                 prs_mem_free(&outgoing_pdu);
 381                 return False;
 382         }
 383
 384         /* Copy the sign/seal padding data. */
 385         if (ss_padding_len) {
 386                 char pad[8];
 387                 memset(pad, '\0', 8);
 388                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 389                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 390                         prs_mem_free(&outgoing_pdu);
 391                         return False;
 392                 }
 393         }
 394
 395         {
 396                 /*
 397                  * Schannel processing.
 398                  */
 399                 char *data;
 400                 RPC_HDR_AUTH auth_info;
 401                 RPC_AUTH_SCHANNEL_CHK verf;
 402
 403                 data = prs_data_p(&outgoing_pdu) + data_pos;
 404                 /* Check it's the type of reply we were expecting to decode */
 405
 406                 init_rpc_hdr_auth(&auth_info,
 407                                 RPC_SCHANNEL_AUTH_TYPE,
 408                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 409                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 410                                 ss_padding_len, 1);
 411
 412                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 413                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 414                         prs_mem_free(&outgoing_pdu);
 415                         return False;
 416                 }
 417
 418                 schannel_encode(p->auth.a_u.schannel_auth,
 419                               p->auth.auth_level,
 420                               SENDER_IS_ACCEPTOR,
 421                               &verf, data, data_len + ss_padding_len);
 422
 423                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 424                                 &verf, &outgoing_pdu, 0)) {
 425                         prs_mem_free(&outgoing_pdu);
 426                         return False;
 427                 }
 428
 429                 p->auth.a_u.schannel_auth->seq_num++;
 430         }
 431
 432         /*
 433          * Setup the counts for this PDU.
 434          */
 435
 436         p->out_data.data_sent_length += data_len;
 437         p->out_data.current_pdu_len = p->hdr.frag_len;
 438         p->out_data.current_pdu_sent = 0;
 439
 440         prs_mem_free(&outgoing_pdu);
 441         return True;
 442 }
 443
 444 /*******************************************************************
 445  Generate the next PDU to be returned from the data in p->rdata.
 446  No authentication done.
 447 ********************************************************************/
 448
 449 static BOOL create_next_pdu_noauth(pipes_struct *p)
 450 {
 451         RPC_HDR_RESP hdr_resp;
 452         uint32 data_len;
 453         uint32 data_space_available;
 454         uint32 data_len_left;
 455         prs_struct outgoing_pdu;
 456
 457         /*
 458          * If we're in the fault state, keep returning fault PDU's until
 459          * the pipe gets closed. JRA.
 460          */
 461
 462         if(p->fault_state) {
 463                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 464                 return True;
 465         }
 466
 467         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 468
 469         /* Change the incoming request header to a response. */
 470         p->hdr.pkt_type = RPC_RESPONSE;
 471
 472         /* Set up rpc header flags. */
 473         if (p->out_data.data_sent_length == 0) {
 474                 p->hdr.flags = RPC_FLG_FIRST;
 475         } else {
 476                 p->hdr.flags = 0;
 477         }
 478
 479         /*
 480          * Work out how much we can fit in a single PDU.
 481          */
 482
 483         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 484
 485         /*
 486          * Ensure there really is data left to send.
 487          */
 488
 489         if(!data_len_left) {
 490                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 491                 return False;
 492         }
 493
 494         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 495
 496         /*
 497          * The amount we send is the minimum of the available
 498          * space and the amount left to send.
 499          */
 500
 501         data_len = MIN(data_len_left, data_space_available);
 502
 503         /*
 504          * Set up the alloc hint. This should be the data left to
 505          * send.
 506          */
 507
 508         hdr_resp.alloc_hint = data_len_left;
 509
 510         /*
 511          * Work out if this PDU will be the last.
 512          */
 513
 514         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 515                 p->hdr.flags |= RPC_FLG_LAST;
 516         }
 517
 518         /*
 519          * Set up the header lengths.
 520          */
 521
 522         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 523         p->hdr.auth_len = 0;
 524
 525         /*
 526          * Init the parse struct to point at the outgoing
 527          * data.
 528          */
 529
 530         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 531         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 532
 533         /* Store the header in the data stream. */
 534         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 535                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 536                 prs_mem_free(&outgoing_pdu);
 537                 return False;
 538         }
 539
 540         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 541                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 542                 prs_mem_free(&outgoing_pdu);
 543                 return False;
 544         }
 545
 546         /* Copy the data into the PDU. */
 547
 548         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 549                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 550                 prs_mem_free(&outgoing_pdu);
 551                 return False;
 552         }
 553
 554         /*
 555          * Setup the counts for this PDU.
 556          */
 557
 558         p->out_data.data_sent_length += data_len;
 559         p->out_data.current_pdu_len = p->hdr.frag_len;
 560         p->out_data.current_pdu_sent = 0;
 561
 562         prs_mem_free(&outgoing_pdu);
 563         return True;
 564 }
 565
 566 /*******************************************************************
 567  Generate the next PDU to be returned from the data in p->rdata.
 568 ********************************************************************/
 569
 570 BOOL create_next_pdu(pipes_struct *p)
 571 {
 572         switch(p->auth.auth_level) {
 573                 case PIPE_AUTH_LEVEL_NONE:
 574                 case PIPE_AUTH_LEVEL_CONNECT:
 575                         /* This is incorrect for auth level connect. Fixme. JRA */
 576                         return create_next_pdu_noauth(p);
 577
 578                 default:
 579                         switch(p->auth.auth_type) {
 580                                 case PIPE_AUTH_TYPE_NTLMSSP:
 581                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 582                                         return create_next_pdu_ntlmssp(p);
 583                                 case PIPE_AUTH_TYPE_SCHANNEL:
 584                                         return create_next_pdu_schannel(p);
 585                                 default:
 586                                         break;
 587                         }
 588         }
 589
 590         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 591                         (unsigned int)p->auth.auth_level,
 592                         (unsigned int)p->auth.auth_type));
 593         return False;
 594 }
 595
 596 /*******************************************************************
 597  Process an NTLMSSP authentication response.
 598  If this function succeeds, the user has been authenticated
 599  and their domain, name and calling workstation stored in
 600  the pipe struct.
 601 *******************************************************************/
 602
 603 static BOOL pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 604 {
 605         DATA_BLOB reply;
 606         NTSTATUS status;
 607         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 608
 609         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n", p->name));
 610
 611         ZERO_STRUCT(reply);
 612
 613         memset(p->user_name, '\0', sizeof(p->user_name));
 614         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 615         memset(p->domain, '\0', sizeof(p->domain));
 616         memset(p->wks, '\0', sizeof(p->wks));
 617
 618         /* Set up for non-authenticated user. */
 619         TALLOC_FREE(p->pipe_user.nt_user_token);
 620         p->pipe_user.ut.ngroups = 0;
 621         SAFE_FREE( p->pipe_user.ut.groups);
 622
 623         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 624
 625         /* Don't generate a reply. */
 626         data_blob_free(&reply);
 627
 628         if (!NT_STATUS_IS_OK(status)) {
 629                 return False;
 630         }
 631
 632         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 633            ensure the underlying NTLMSSP flags are also set. If not we should
 634            refuse the bind. */
 635
 636         if (p->auth.auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
 637                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 638                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 639                                 "but client declined signing.\n",
 640                                         p->name ));
 641                         return False;
 642                 }
 643         }
 644         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 645                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 646                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 647                                 "but client declined sealing.\n",
 648                                         p->name ));
 649                         return False;
 650                 }
 651         }
 652
 653         fstrcpy(p->user_name, a->ntlmssp_state->user);
 654         fstrcpy(p->pipe_user_name, a->server_info->unix_name);
 655         fstrcpy(p->domain, a->ntlmssp_state->domain);
 656         fstrcpy(p->wks, a->ntlmssp_state->workstation);
 657
 658         DEBUG(5,("pipe_ntlmssp_verify_final: OK: user: %s domain: %s workstation: %s\n",
 659                 p->user_name, p->domain, p->wks));
 660
 661         /*
 662          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 663          */
 664
 665         p->pipe_user.ut.uid = a->server_info->uid;
 666         p->pipe_user.ut.gid = a->server_info->gid;
 667
 668         /*
 669          * Copy the session key from the ntlmssp state.
 670          */
 671
 672         data_blob_free(&p->session_key);
 673         p->session_key = data_blob(a->ntlmssp_state->session_key.data, a->ntlmssp_state->session_key.length);
 674         if (!p->session_key.data) {
 675                 return False;
 676         }
 677
 678         p->pipe_user.ut.ngroups = a->server_info->n_groups;
 679         if (p->pipe_user.ut.ngroups) {
 680                 if (!(p->pipe_user.ut.groups = memdup(a->server_info->groups,
 681                                                 sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
 682                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 683                         return False;
 684                 }
 685         }
 686
 687         if (a->server_info->ptok) {
 688                 p->pipe_user.nt_user_token =
 689                         dup_nt_token(NULL, a->server_info->ptok);
 690         } else {
 691                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 692                 p->pipe_user.nt_user_token = NULL;
 693                 return False;
 694         }
 695
 696         return True;
 697 }
 698
 699 /*******************************************************************
 700  The switch table for the pipe names and the functions to handle them.
 701 *******************************************************************/
 702
 703 struct rpc_table {
 704         struct {
 705                 const char *clnt;
 706                 const char *srv;
 707         } pipe;
 708         struct api_struct *cmds;
 709         int n_cmds;
 710 };
 711
 712 static struct rpc_table *rpc_lookup;
 713 static int rpc_lookup_size;
 714
 715 /*******************************************************************
 716  This is the "stage3" NTLMSSP response after a bind request and reply.
 717 *******************************************************************/
 718
 719 BOOL api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 720 {
 721         RPC_HDR_AUTH auth_info;
 722         uint32 pad;
 723         DATA_BLOB blob;
 724
 725         ZERO_STRUCT(blob);
 726
 727         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 728
 729         if (p->hdr.auth_len == 0) {
 730                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 731                 goto err;
 732         }
 733
 734         /* 4 bytes padding. */
 735         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 736                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 737                 goto err;
 738         }
 739
 740         /*
 741          * Decode the authentication verifier response.
 742          */
 743
 744         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 745                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 746                 goto err;
 747         }
 748
 749         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 750                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 751                         (unsigned int)auth_info.auth_type ));
 752                 return False;
 753         }
 754
 755         blob = data_blob(NULL,p->hdr.auth_len);
 756
 757         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 758                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 759                         (unsigned int)p->hdr.auth_len ));
 760                 goto err;
 761         }
 762
 763         /*
 764          * The following call actually checks the challenge/response data.
 765          * for correctness against the given DOMAIN\user name.
 766          */
 767
 768         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 769                 goto err;
 770         }
 771
 772         data_blob_free(&blob);
 773
 774         p->pipe_bound = True;
 775
 776         return True;
 777
 778  err:
 779
 780         data_blob_free(&blob);
 781         free_pipe_ntlmssp_auth_data(&p->auth);
 782         p->auth.a_u.auth_ntlmssp_state = NULL;
 783
 784         return False;
 785 }
 786
 787 /*******************************************************************
 788  Marshall a bind_nak pdu.
 789 *******************************************************************/
 790
 791 static BOOL setup_bind_nak(pipes_struct *p)
 792 {
 793         prs_struct outgoing_rpc;
 794         RPC_HDR nak_hdr;
 795         uint16 zero = 0;
 796
 797         /* Free any memory in the current return data buffer. */
 798         prs_mem_free(&p->out_data.rdata);
 799
 800         /*
 801          * Marshall directly into the outgoing PDU space. We
 802          * must do this as we need to set to the bind response
 803          * header and are never sending more than one PDU here.
 804          */
 805
 806         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 807         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 808
 809         /*
 810          * Initialize a bind_nak header.
 811          */
 812
 813         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 814                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 815
 816         /*
 817          * Marshall the header into the outgoing PDU.
 818          */
 819
 820         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 821                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 822                 prs_mem_free(&outgoing_rpc);
 823                 return False;
 824         }
 825
 826         /*
 827          * Now add the reject reason.
 828          */
 829
 830         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 831                 prs_mem_free(&outgoing_rpc);
 832                 return False;
 833         }
 834
 835         p->out_data.data_sent_length = 0;
 836         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 837         p->out_data.current_pdu_sent = 0;
 838
 839         if (p->auth.auth_data_free_func) {
 840                 (*p->auth.auth_data_free_func)(&p->auth);
 841         }
 842         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 843         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 844         p->pipe_bound = False;
 845
 846         return True;
 847 }
 848
 849 /*******************************************************************
 850  Marshall a fault pdu.
 851 *******************************************************************/
 852
 853 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 854 {
 855         prs_struct outgoing_pdu;
 856         RPC_HDR fault_hdr;
 857         RPC_HDR_RESP hdr_resp;
 858         RPC_HDR_FAULT fault_resp;
 859
 860         /* Free any memory in the current return data buffer. */
 861         prs_mem_free(&p->out_data.rdata);
 862
 863         /*
 864          * Marshall directly into the outgoing PDU space. We
 865          * must do this as we need to set to the bind response
 866          * header and are never sending more than one PDU here.
 867          */
 868
 869         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 870         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 871
 872         /*
 873          * Initialize a fault header.
 874          */
 875
 876         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 877             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 878
 879         /*
 880          * Initialize the HDR_RESP and FAULT parts of the PDU.
 881          */
 882
 883         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 884
 885         fault_resp.status = status;
 886         fault_resp.reserved = 0;
 887
 888         /*
 889          * Marshall the header into the outgoing PDU.
 890          */
 891
 892         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 893                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 894                 prs_mem_free(&outgoing_pdu);
 895                 return False;
 896         }
 897
 898         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 899                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 900                 prs_mem_free(&outgoing_pdu);
 901                 return False;
 902         }
 903
 904         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 905                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 906                 prs_mem_free(&outgoing_pdu);
 907                 return False;
 908         }
 909
 910         p->out_data.data_sent_length = 0;
 911         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 912         p->out_data.current_pdu_sent = 0;
 913
 914         prs_mem_free(&outgoing_pdu);
 915         return True;
 916 }
 917
 918 #if 0
 919 /*******************************************************************
 920  Marshall a cancel_ack pdu.
 921  We should probably check the auth-verifier here.
 922 *******************************************************************/
 923
 924 BOOL setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 925 {
 926         prs_struct outgoing_pdu;
 927         RPC_HDR ack_reply_hdr;
 928
 929         /* Free any memory in the current return data buffer. */
 930         prs_mem_free(&p->out_data.rdata);
 931
 932         /*
 933          * Marshall directly into the outgoing PDU space. We
 934          * must do this as we need to set to the bind response
 935          * header and are never sending more than one PDU here.
 936          */
 937
 938         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 939         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 940
 941         /*
 942          * Initialize a cancel_ack header.
 943          */
 944
 945         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 946                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 947
 948         /*
 949          * Marshall the header into the outgoing PDU.
 950          */
 951
 952         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 953                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 954                 prs_mem_free(&outgoing_pdu);
 955                 return False;
 956         }
 957
 958         p->out_data.data_sent_length = 0;
 959         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 960         p->out_data.current_pdu_sent = 0;
 961
 962         prs_mem_free(&outgoing_pdu);
 963         return True;
 964 }
 965 #endif
 966
 967 /*******************************************************************
 968  Ensure a bind request has the correct abstract & transfer interface.
 969  Used to reject unknown binds from Win2k.
 970 *******************************************************************/
 971
 972 BOOL check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 973                     RPC_IFACE* transfer, uint32 context_id)
 974 {
 975         char *pipe_name = p->name;
 976         int i=0;
 977         fstring pname;
 978
 979         fstrcpy(pname,"\\PIPE\\");
 980         fstrcat(pname,pipe_name);
 981
 982         DEBUG(3,("check_bind_req for %s\n", pname));
 983
 984         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 985
 986         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 987                 DEBUG(10,("checking %s\n", pipe_names[i].client_pipe));
 988                 if ( strequal(pipe_names[i].client_pipe, pname)
 989                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 990                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(struct uuid)) == 0)
 991                         && (transfer->version == pipe_names[i].trans_syntax.version)
 992                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(struct uuid)) == 0) ) {
 993                         struct api_struct       *fns = NULL;
 994                         int                     n_fns = 0;
 995                         PIPE_RPC_FNS            *context_fns;
 996
 997                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
 998                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 999                                 return False;
1000                         }
1001
1002                         /* save the RPC function table associated with this bind */
1003
1004                         get_pipe_fns(i, &fns, &n_fns);
1005
1006                         context_fns->cmds = fns;
1007                         context_fns->n_cmds = n_fns;
1008                         context_fns->context_id = context_id;
1009
1010                         /* add to the list of open contexts */
1011
1012                         DLIST_ADD( p->contexts, context_fns );
1013
1014                         break;
1015                 }
1016         }
1017
1018         if(pipe_names[i].client_pipe == NULL) {
1019                 return False;
1020         }
1021
1022         return True;
1023 }
1024
1025 /*******************************************************************
1026  Register commands to an RPC pipe
1027 *******************************************************************/
1028
1029 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
1030 {
1031         struct rpc_table *rpc_entry;
1032
1033         if (!clnt || !srv || !cmds) {
1034                 return NT_STATUS_INVALID_PARAMETER;
1035         }
1036
1037         if (version != SMB_RPC_INTERFACE_VERSION) {
1038                 DEBUG(0,("Can't register rpc commands!\n"
1039                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1040                          ", while this version of samba uses version %d!\n",
1041                          version,SMB_RPC_INTERFACE_VERSION));
1042                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1043         }
1044
1045         /* TODO:
1046          *
1047          * we still need to make sure that don't register the same commands twice!!!
1048          *
1049          * --metze
1050          */
1051
1052         /* We use a temporary variable because this call can fail and
1053            rpc_lookup will still be valid afterwards.  It could then succeed if
1054            called again later */
1055         rpc_lookup_size++;
1056         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1057         if (NULL == rpc_entry) {
1058                 rpc_lookup_size--;
1059                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1060                 return NT_STATUS_NO_MEMORY;
1061         } else {
1062                 rpc_lookup = rpc_entry;
1063         }
1064
1065         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1066         ZERO_STRUCTP(rpc_entry);
1067         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1068         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1069         rpc_entry->cmds = SMB_REALLOC_ARRAY(rpc_entry->cmds, struct api_struct, rpc_entry->n_cmds + size);
1070         if (!rpc_entry->cmds) {
1071                 return NT_STATUS_NO_MEMORY;
1072         }
1073         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds, size * sizeof(struct api_struct));
1074         rpc_entry->n_cmds += size;
1075
1076         return NT_STATUS_OK;
1077 }
1078
1079 /*******************************************************************
1080  Handle a SPNEGO krb5 bind auth.
1081 *******************************************************************/
1082
1083 static BOOL pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1084                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1085 {
1086         return False;
1087 }
1088
1089 /*******************************************************************
1090  Handle the first part of a SPNEGO bind auth.
1091 *******************************************************************/
1092
1093 static BOOL pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1094                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1095 {
1096         DATA_BLOB blob;
1097         DATA_BLOB secblob;
1098         DATA_BLOB response;
1099         DATA_BLOB chal;
1100         char *OIDs[ASN1_MAX_OIDS];
1101         int i;
1102         NTSTATUS status;
1103         BOOL got_kerberos_mechanism = False;
1104         AUTH_NTLMSSP_STATE *a = NULL;
1105         RPC_HDR_AUTH auth_info;
1106
1107         ZERO_STRUCT(secblob);
1108         ZERO_STRUCT(chal);
1109         ZERO_STRUCT(response);
1110
1111         /* Grab the SPNEGO blob. */
1112         blob = data_blob(NULL,p->hdr.auth_len);
1113
1114         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1115                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1116                         (unsigned int)p->hdr.auth_len ));
1117                 goto err;
1118         }
1119
1120         if (blob.data[0] != ASN1_APPLICATION(0)) {
1121                 goto err;
1122         }
1123
1124         /* parse out the OIDs and the first sec blob */
1125         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1126                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1127                 goto err;
1128         }
1129
1130         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1131                 got_kerberos_mechanism = True;
1132         }
1133
1134         for (i=0;OIDs[i];i++) {
1135                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1136                 SAFE_FREE(OIDs[i]);
1137         }
1138         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1139
1140         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1141                 BOOL ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1142                 data_blob_free(&secblob);
1143                 data_blob_free(&blob);
1144                 return ret;
1145         }
1146
1147         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1148                 /* Free any previous auth type. */
1149                 free_pipe_ntlmssp_auth_data(&p->auth);
1150         }
1151
1152         /* Initialize the NTLM engine. */
1153         status = auth_ntlmssp_start(&a);
1154         if (!NT_STATUS_IS_OK(status)) {
1155                 goto err;
1156         }
1157
1158         /*
1159          * Pass the first security blob of data to it.
1160          * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1161          * which means we need another packet to complete the bind.
1162          */
1163
1164         status = auth_ntlmssp_update(a, secblob, &chal);
1165
1166         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1167                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1168                 goto err;
1169         }
1170
1171         /* Generate the response blob we need for step 2 of the bind. */
1172         response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1173
1174         /* Copy the blob into the pout_auth parse struct */
1175         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1176         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1177                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1178                 goto err;
1179         }
1180
1181         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1182                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1183                 goto err;
1184         }
1185
1186         p->auth.a_u.auth_ntlmssp_state = a;
1187         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1188         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1189
1190         data_blob_free(&blob);
1191         data_blob_free(&secblob);
1192         data_blob_free(&chal);
1193         data_blob_free(&response);
1194
1195         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1196         return True;
1197
1198  err:
1199
1200         data_blob_free(&blob);
1201         data_blob_free(&secblob);
1202         data_blob_free(&chal);
1203         data_blob_free(&response);
1204
1205         p->auth.a_u.auth_ntlmssp_state = NULL;
1206
1207         return False;
1208 }
1209
1210 /*******************************************************************
1211  Handle the second part of a SPNEGO bind auth.
1212 *******************************************************************/
1213
1214 static BOOL pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1215                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1216 {
1217         RPC_HDR_AUTH auth_info;
1218         DATA_BLOB spnego_blob;
1219         DATA_BLOB auth_blob;
1220         DATA_BLOB auth_reply;
1221         DATA_BLOB response;
1222         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1223
1224         ZERO_STRUCT(spnego_blob);
1225         ZERO_STRUCT(auth_blob);
1226         ZERO_STRUCT(auth_reply);
1227         ZERO_STRUCT(response);
1228
1229         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1230                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1231                 goto err;
1232         }
1233
1234         /* Grab the SPNEGO blob. */
1235         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1236
1237         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1238                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1239                         (unsigned int)p->hdr.auth_len ));
1240                 goto err;
1241         }
1242
1243         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1244                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1245                 goto err;
1246         }
1247
1248         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1249                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1250                 goto err;
1251         }
1252
1253         /*
1254          * The following call actually checks the challenge/response data.
1255          * for correctness against the given DOMAIN\user name.
1256          */
1257
1258         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1259                 goto err;
1260         }
1261
1262         data_blob_free(&spnego_blob);
1263         data_blob_free(&auth_blob);
1264
1265         /* Generate the spnego "accept completed" blob - no incoming data. */
1266         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1267
1268         /* Copy the blob into the pout_auth parse struct */
1269         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1270         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1271                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1272                 goto err;
1273         }
1274
1275         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1276                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1277                 goto err;
1278         }
1279
1280         data_blob_free(&auth_reply);
1281         data_blob_free(&response);
1282
1283         p->pipe_bound = True;
1284
1285         return True;
1286
1287  err:
1288
1289         data_blob_free(&spnego_blob);
1290         data_blob_free(&auth_blob);
1291         data_blob_free(&auth_reply);
1292         data_blob_free(&response);
1293
1294         free_pipe_ntlmssp_auth_data(&p->auth);
1295         p->auth.a_u.auth_ntlmssp_state = NULL;
1296
1297         return False;
1298 }
1299
1300 /*******************************************************************
1301  Handle an schannel bind auth.
1302 *******************************************************************/
1303
1304 static BOOL pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1305                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1306 {
1307         RPC_HDR_AUTH auth_info;
1308         RPC_AUTH_SCHANNEL_NEG neg;
1309         RPC_AUTH_VERIFIER auth_verifier;
1310         BOOL ret;
1311         struct dcinfo *pdcinfo;
1312         uint32 flags;
1313
1314         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1315                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1316                 return False;
1317         }
1318
1319         /*
1320          * The neg.myname key here must match the remote computer name
1321          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1322          * operations that use credentials.
1323          */
1324
1325         become_root();
1326         ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &pdcinfo);
1327         unbecome_root();
1328
1329         if (!ret) {
1330                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1331                 return False;
1332         }
1333
1334         p->auth.a_u.schannel_auth = TALLOC_P(p->pipe_state_mem_ctx, struct schannel_auth_struct);
1335         if (!p->auth.a_u.schannel_auth) {
1336                 TALLOC_FREE(pdcinfo);
1337                 return False;
1338         }
1339
1340         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1341         memcpy(p->auth.a_u.schannel_auth->sess_key, pdcinfo->sess_key,
1342                         sizeof(pdcinfo->sess_key));
1343
1344         TALLOC_FREE(pdcinfo);
1345
1346         p->auth.a_u.schannel_auth->seq_num = 0;
1347
1348         /*
1349          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1350          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1351          * struct of the person who opened the pipe. I need to test this further. JRA.
1352          */
1353
1354         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1355         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1356                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1357                 return False;
1358         }
1359
1360         /*** SCHANNEL verifier ***/
1361
1362         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1363         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1364                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1365                 return False;
1366         }
1367
1368         prs_align(pout_auth);
1369
1370         flags = 5;
1371         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1372                 return False;
1373         }
1374
1375         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1376                 neg.domain, neg.myname));
1377
1378         /* We're finished with this bind - no more packets. */
1379         p->auth.auth_data_free_func = NULL;
1380         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1381
1382         p->pipe_bound = True;
1383
1384         return True;
1385 }
1386
1387 /*******************************************************************
1388  Handle an NTLMSSP bind auth.
1389 *******************************************************************/
1390
1391 static BOOL pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1392                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1393 {
1394         RPC_HDR_AUTH auth_info;
1395         DATA_BLOB blob;
1396         DATA_BLOB response;
1397         NTSTATUS status;
1398         AUTH_NTLMSSP_STATE *a = NULL;
1399
1400         ZERO_STRUCT(blob);
1401         ZERO_STRUCT(response);
1402
1403         /* Grab the NTLMSSP blob. */
1404         blob = data_blob(NULL,p->hdr.auth_len);
1405
1406         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1407                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1408                         (unsigned int)p->hdr.auth_len ));
1409                 goto err;
1410         }
1411
1412         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1413                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1414                 goto err;
1415         }
1416
1417         /* We have an NTLMSSP blob. */
1418         status = auth_ntlmssp_start(&a);
1419         if (!NT_STATUS_IS_OK(status)) {
1420                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1421                         nt_errstr(status) ));
1422                 goto err;
1423         }
1424
1425         status = auth_ntlmssp_update(a, blob, &response);
1426         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1427                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1428                         nt_errstr(status) ));
1429                 goto err;
1430         }
1431
1432         data_blob_free(&blob);
1433
1434         /* Copy the blob into the pout_auth parse struct */
1435         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1436         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1437                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1438                 goto err;
1439         }
1440
1441         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1442                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1443                 goto err;
1444         }
1445
1446         p->auth.a_u.auth_ntlmssp_state = a;
1447         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1448         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1449
1450         data_blob_free(&blob);
1451         data_blob_free(&response);
1452
1453         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1454
1455         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1456         return True;
1457
1458   err:
1459
1460         data_blob_free(&blob);
1461         data_blob_free(&response);
1462
1463         free_pipe_ntlmssp_auth_data(&p->auth);
1464         p->auth.a_u.auth_ntlmssp_state = NULL;
1465         return False;
1466 }
1467
1468 /*******************************************************************
1469  Respond to a pipe bind request.
1470 *******************************************************************/
1471
1472 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1473 {
1474         RPC_HDR_BA hdr_ba;
1475         RPC_HDR_RB hdr_rb;
1476         RPC_HDR_AUTH auth_info;
1477         uint16 assoc_gid;
1478         fstring ack_pipe_name;
1479         prs_struct out_hdr_ba;
1480         prs_struct out_auth;
1481         prs_struct outgoing_rpc;
1482         int i = 0;
1483         int auth_len = 0;
1484         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1485
1486         /* No rebinds on a bound pipe - use alter context. */
1487         if (p->pipe_bound) {
1488                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1489                 return setup_bind_nak(p);
1490         }
1491
1492         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1493
1494         /*
1495          * Marshall directly into the outgoing PDU space. We
1496          * must do this as we need to set to the bind response
1497          * header and are never sending more than one PDU here.
1498          */
1499
1500         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1501
1502         /*
1503          * Setup the memory to marshall the ba header, and the
1504          * auth footers.
1505          */
1506
1507         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1508                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1509                 prs_mem_free(&outgoing_rpc);
1510                 return False;
1511         }
1512
1513         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1514                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1515                 prs_mem_free(&outgoing_rpc);
1516                 prs_mem_free(&out_hdr_ba);
1517                 return False;
1518         }
1519
1520         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1521
1522         /*
1523          * Try and find the correct pipe name to ensure
1524          * that this is a pipe name we support.
1525          */
1526
1527
1528         for (i = 0; i < rpc_lookup_size; i++) {
1529                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1530                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1531                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1532                         fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1533                         break;
1534                 }
1535         }
1536
1537         if (i == rpc_lookup_size) {
1538                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1539                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1540                                 p->name ));
1541                         prs_mem_free(&outgoing_rpc);
1542                         prs_mem_free(&out_hdr_ba);
1543                         prs_mem_free(&out_auth);
1544
1545                         return setup_bind_nak(p);
1546                 }
1547
1548                 for (i = 0; i < rpc_lookup_size; i++) {
1549                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1550                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1551                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1552                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1553                                break;
1554                        }
1555                 }
1556
1557                 if (i == rpc_lookup_size) {
1558                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1559                         goto err_exit;
1560                 }
1561         }
1562
1563         /* decode the bind request */
1564         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1565                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
1566                 goto err_exit;
1567         }
1568
1569         /* name has to be \PIPE\xxxxx */
1570         fstrcpy(ack_pipe_name, "\\PIPE\\");
1571         fstrcat(ack_pipe_name, p->pipe_srv_name);
1572
1573         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1574
1575         /*
1576          * Check if this is an authenticated bind request.
1577          */
1578
1579         if (p->hdr.auth_len) {
1580                 /*
1581                  * Decode the authentication verifier.
1582                  */
1583
1584                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1585                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1586                         goto err_exit;
1587                 }
1588
1589                 auth_type = auth_info.auth_type;
1590
1591                 /* Work out if we have to sign or seal etc. */
1592                 switch (auth_info.auth_level) {
1593                         case RPC_AUTH_LEVEL_INTEGRITY:
1594                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1595                                 break;
1596                         case RPC_AUTH_LEVEL_PRIVACY:
1597                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1598                                 break;
1599                         default:
1600                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1601                                         (unsigned int)auth_info.auth_level ));
1602                                 goto err_exit;
1603                 }
1604         } else {
1605                 ZERO_STRUCT(auth_info);
1606         }
1607
1608         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1609
1610         switch(auth_type) {
1611                 case RPC_NTLMSSP_AUTH_TYPE:
1612                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1613                                 goto err_exit;
1614                         }
1615                         assoc_gid = 0x7a77;
1616                         break;
1617
1618                 case RPC_SCHANNEL_AUTH_TYPE:
1619                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1620                                 goto err_exit;
1621                         }
1622                         break;
1623
1624                 case RPC_SPNEGO_AUTH_TYPE:
1625                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1626                                 goto err_exit;
1627                         }
1628                         break;
1629
1630                 case RPC_ANONYMOUS_AUTH_TYPE:
1631                         /* Unauthenticated bind request. */
1632                         /* We're finished - no more packets. */
1633                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1634                         /* We must set the pipe auth_level here also. */
1635                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1636                         p->pipe_bound = True;
1637                         break;
1638
1639                 default:
1640                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1641                         goto err_exit;
1642         }
1643
1644         /*
1645          * Create the bind response struct.
1646          */
1647
1648         /* If the requested abstract synt uuid doesn't match our client pipe,
1649                 reject the bind_ack & set the transfer interface synt to all 0's,
1650                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1651                 unknown to NT4)
1652                 Needed when adding entries to a DACL from NT5 - SK */
1653
1654         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1655                                 hdr_rb.rpc_context[0].context_id )) {
1656                 init_rpc_hdr_ba(&hdr_ba,
1657                         RPC_MAX_PDU_FRAG_LEN,
1658                         RPC_MAX_PDU_FRAG_LEN,
1659                         assoc_gid,
1660                         ack_pipe_name,
1661                         0x1, 0x0, 0x0,
1662                         &hdr_rb.rpc_context[0].transfer[0]);
1663         } else {
1664                 RPC_IFACE null_interface;
1665                 ZERO_STRUCT(null_interface);
1666                 /* Rejection reason: abstract syntax not supported */
1667                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1668                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1669                                         ack_pipe_name, 0x1, 0x2, 0x1,
1670                                         &null_interface);
1671                 p->pipe_bound = False;
1672         }
1673
1674         /*
1675          * and marshall it.
1676          */
1677
1678         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1679                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1680                 goto err_exit;
1681         }
1682
1683         /*
1684          * Create the header, now we know the length.
1685          */
1686
1687         if (prs_offset(&out_auth)) {
1688                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1689         }
1690
1691         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1692                         p->hdr.call_id,
1693                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1694                         auth_len);
1695
1696         /*
1697          * Marshall the header into the outgoing PDU.
1698          */
1699
1700         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1701                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1702                 goto err_exit;
1703         }
1704
1705         /*
1706          * Now add the RPC_HDR_BA and any auth needed.
1707          */
1708
1709         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1710                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1711                 goto err_exit;
1712         }
1713
1714         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1715                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1716                 goto err_exit;
1717         }
1718
1719         /*
1720          * Setup the lengths for the initial reply.
1721          */
1722
1723         p->out_data.data_sent_length = 0;
1724         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1725         p->out_data.current_pdu_sent = 0;
1726
1727         prs_mem_free(&out_hdr_ba);
1728         prs_mem_free(&out_auth);
1729
1730         return True;
1731
1732   err_exit:
1733
1734         prs_mem_free(&outgoing_rpc);
1735         prs_mem_free(&out_hdr_ba);
1736         prs_mem_free(&out_auth);
1737         return setup_bind_nak(p);
1738 }
1739
1740 /****************************************************************************
1741  Deal with an alter context call. Can be third part of 3 leg auth request for
1742  SPNEGO calls.
1743 ****************************************************************************/
1744
1745 BOOL api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1746 {
1747         RPC_HDR_BA hdr_ba;
1748         RPC_HDR_RB hdr_rb;
1749         RPC_HDR_AUTH auth_info;
1750         uint16 assoc_gid;
1751         fstring ack_pipe_name;
1752         prs_struct out_hdr_ba;
1753         prs_struct out_auth;
1754         prs_struct outgoing_rpc;
1755         int auth_len = 0;
1756
1757         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1758
1759         /*
1760          * Marshall directly into the outgoing PDU space. We
1761          * must do this as we need to set to the bind response
1762          * header and are never sending more than one PDU here.
1763          */
1764
1765         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1766
1767         /*
1768          * Setup the memory to marshall the ba header, and the
1769          * auth footers.
1770          */
1771
1772         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1773                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1774                 prs_mem_free(&outgoing_rpc);
1775                 return False;
1776         }
1777
1778         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1779                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1780                 prs_mem_free(&outgoing_rpc);
1781                 prs_mem_free(&out_hdr_ba);
1782                 return False;
1783         }
1784
1785         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1786
1787         /* decode the alter context request */
1788         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1789                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1790                 goto err_exit;
1791         }
1792
1793         /* secondary address CAN be NULL
1794          * as the specs say it's ignored.
1795          * It MUST be NULL to have the spoolss working.
1796          */
1797         fstrcpy(ack_pipe_name,"");
1798
1799         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1800
1801         /*
1802          * Check if this is an authenticated alter context request.
1803          */
1804
1805         if (p->hdr.auth_len != 0) {
1806                 /*
1807                  * Decode the authentication verifier.
1808                  */
1809
1810                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1811                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1812                         goto err_exit;
1813                 }
1814
1815                 /*
1816                  * Currently only the SPNEGO auth type uses the alter ctx
1817                  * response in place of the NTLMSSP auth3 type.
1818                  */
1819
1820                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1821                         /* We can only finish if the pipe is unbound. */
1822                         if (!p->pipe_bound) {
1823                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1824                                         goto err_exit;
1825                                 }
1826                         } else {
1827                                 goto err_exit;
1828                         }
1829                 }
1830         } else {
1831                 ZERO_STRUCT(auth_info);
1832         }
1833
1834         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1835
1836         /*
1837          * Create the bind response struct.
1838          */
1839
1840         /* If the requested abstract synt uuid doesn't match our client pipe,
1841                 reject the bind_ack & set the transfer interface synt to all 0's,
1842                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1843                 unknown to NT4)
1844                 Needed when adding entries to a DACL from NT5 - SK */
1845
1846         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1847                                 hdr_rb.rpc_context[0].context_id )) {
1848                 init_rpc_hdr_ba(&hdr_ba,
1849                         RPC_MAX_PDU_FRAG_LEN,
1850                         RPC_MAX_PDU_FRAG_LEN,
1851                         assoc_gid,
1852                         ack_pipe_name,
1853                         0x1, 0x0, 0x0,
1854                         &hdr_rb.rpc_context[0].transfer[0]);
1855         } else {
1856                 RPC_IFACE null_interface;
1857                 ZERO_STRUCT(null_interface);
1858                 /* Rejection reason: abstract syntax not supported */
1859                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1860                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1861                                         ack_pipe_name, 0x1, 0x2, 0x1,
1862                                         &null_interface);
1863                 p->pipe_bound = False;
1864         }
1865
1866         /*
1867          * and marshall it.
1868          */
1869
1870         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1871                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1872                 goto err_exit;
1873         }
1874
1875         /*
1876          * Create the header, now we know the length.
1877          */
1878
1879         if (prs_offset(&out_auth)) {
1880                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1881         }
1882
1883         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1884                         p->hdr.call_id,
1885                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1886                         auth_len);
1887
1888         /*
1889          * Marshall the header into the outgoing PDU.
1890          */
1891
1892         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1893                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1894                 goto err_exit;
1895         }
1896
1897         /*
1898          * Now add the RPC_HDR_BA and any auth needed.
1899          */
1900
1901         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1902                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1903                 goto err_exit;
1904         }
1905
1906         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1907                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1908                 goto err_exit;
1909         }
1910
1911         /*
1912          * Setup the lengths for the initial reply.
1913          */
1914
1915         p->out_data.data_sent_length = 0;
1916         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1917         p->out_data.current_pdu_sent = 0;
1918
1919         prs_mem_free(&out_hdr_ba);
1920         prs_mem_free(&out_auth);
1921
1922         return True;
1923
1924   err_exit:
1925
1926         prs_mem_free(&outgoing_rpc);
1927         prs_mem_free(&out_hdr_ba);
1928         prs_mem_free(&out_auth);
1929         return setup_bind_nak(p);
1930 }
1931
1932 /****************************************************************************
1933  Deal with NTLMSSP sign & seal processing on an RPC request.
1934 ****************************************************************************/
1935
1936 BOOL api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1937                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1938 {
1939         RPC_HDR_AUTH auth_info;
1940         uint32 auth_len = p->hdr.auth_len;
1941         uint32 save_offset = prs_offset(rpc_in);
1942         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1943         unsigned char *data = NULL;
1944         size_t data_len;
1945         unsigned char *full_packet_data = NULL;
1946         size_t full_packet_data_len;
1947         DATA_BLOB auth_blob;
1948
1949         *pstatus = NT_STATUS_OK;
1950
1951         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
1952                 return True;
1953         }
1954
1955         if (!a) {
1956                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1957                 return False;
1958         }
1959
1960         /* Ensure there's enough data for an authenticated request. */
1961         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
1962                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
1963                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
1964                         (unsigned int)auth_len ));
1965                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1966                 return False;
1967         }
1968
1969         /*
1970          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
1971          * after the RPC header.
1972          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
1973          * functions as NTLMv2 checks the rpc headers also.
1974          */
1975
1976         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
1977         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
1978
1979         full_packet_data = p->in_data.current_in_pdu;
1980         full_packet_data_len = p->hdr.frag_len - auth_len;
1981
1982         /* Pull the auth header and the following data into a blob. */
1983         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
1984                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
1985                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
1986                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1987                 return False;
1988         }
1989
1990         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1991                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1992                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1993                 return False;
1994         }
1995
1996         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
1997         auth_blob.length = auth_len;
1998
1999         switch (p->auth.auth_level) {
2000                 case PIPE_AUTH_LEVEL_PRIVACY:
2001                         /* Data is encrypted. */
2002                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2003                                                         data, data_len,
2004                                                         full_packet_data,
2005                                                         full_packet_data_len,
2006                                                         &auth_blob);
2007                         if (!NT_STATUS_IS_OK(*pstatus)) {
2008                                 return False;
2009                         }
2010                         break;
2011                 case PIPE_AUTH_LEVEL_INTEGRITY:
2012                         /* Data is signed. */
2013                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2014                                                         data, data_len,
2015                                                         full_packet_data,
2016                                                         full_packet_data_len,
2017                                                         &auth_blob);
2018                         if (!NT_STATUS_IS_OK(*pstatus)) {
2019                                 return False;
2020                         }
2021                         break;
2022                 default:
2023                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2024                         return False;
2025         }
2026
2027         /*
2028          * Return the current pointer to the data offset.
2029          */
2030
2031         if(!prs_set_offset(rpc_in, save_offset)) {
2032                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2033                         (unsigned int)save_offset ));
2034                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2035                 return False;
2036         }
2037
2038         /*
2039          * Remember the padding length. We must remove it from the real data
2040          * stream once the sign/seal is done.
2041          */
2042
2043         *p_ss_padding_len = auth_info.auth_pad_len;
2044
2045         return True;
2046 }
2047
2048 /****************************************************************************
2049  Deal with schannel processing on an RPC request.
2050 ****************************************************************************/
2051
2052 BOOL api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2053 {
2054         uint32 data_len;
2055         uint32 auth_len;
2056         uint32 save_offset = prs_offset(rpc_in);
2057         RPC_HDR_AUTH auth_info;
2058         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2059
2060         auth_len = p->hdr.auth_len;
2061
2062         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2063                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2064                 return False;
2065         }
2066
2067         /*
2068          * The following is that length of the data we must verify or unseal.
2069          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2070          * preceeding the auth_data.
2071          */
2072
2073         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2074                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2075                         (unsigned int)p->hdr.frag_len,
2076                         (unsigned int)auth_len ));
2077                 return False;
2078         }
2079
2080         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2081                 RPC_HDR_AUTH_LEN - auth_len;
2082
2083         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2084
2085         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2086                 DEBUG(0,("cannot move offset to %u.\n",
2087                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2088                 return False;
2089         }
2090
2091         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2092                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2093                 return False;
2094         }
2095
2096         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2097                 DEBUG(0,("Invalid auth info %d on schannel\n",
2098                          auth_info.auth_type));
2099                 return False;
2100         }
2101
2102         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2103                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2104                 return False;
2105         }
2106
2107         if (!schannel_decode(p->auth.a_u.schannel_auth,
2108                            p->auth.auth_level,
2109                            SENDER_IS_INITIATOR,
2110                            &schannel_chk,
2111                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2112                 DEBUG(3,("failed to decode PDU\n"));
2113                 return False;
2114         }
2115
2116         /*
2117          * Return the current pointer to the data offset.
2118          */
2119
2120         if(!prs_set_offset(rpc_in, save_offset)) {
2121                 DEBUG(0,("failed to set offset back to %u\n",
2122                          (unsigned int)save_offset ));
2123                 return False;
2124         }
2125
2126         /* The sequence number gets incremented on both send and receive. */
2127         p->auth.a_u.schannel_auth->seq_num++;
2128
2129         /*
2130          * Remember the padding length. We must remove it from the real data
2131          * stream once the sign/seal is done.
2132          */
2133
2134         *p_ss_padding_len = auth_info.auth_pad_len;
2135
2136         return True;
2137 }
2138
2139 /****************************************************************************
2140  Return a user struct for a pipe user.
2141 ****************************************************************************/
2142
2143 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
2144 {
2145         if (p->pipe_bound &&
2146                         (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
2147                         (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2148                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
2149         } else {
2150                 memcpy(user, &current_user, sizeof(struct current_user));
2151         }
2152
2153         return user;
2154 }
2155
2156 /****************************************************************************
2157  Find the set of RPC functions associated with this context_id
2158 ****************************************************************************/
2159
2160 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2161 {
2162         PIPE_RPC_FNS *fns = NULL;
2163         PIPE_RPC_FNS *tmp = NULL;
2164
2165         if ( !list ) {
2166                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2167                 return NULL;
2168         }
2169
2170         for (tmp=list; tmp; tmp=tmp->next ) {
2171                 if ( tmp->context_id == context_id )
2172                         break;
2173         }
2174
2175         fns = tmp;
2176
2177         return fns;
2178 }
2179
2180 /****************************************************************************
2181  Memory cleanup.
2182 ****************************************************************************/
2183
2184 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2185 {
2186         PIPE_RPC_FNS *tmp = list;
2187         PIPE_RPC_FNS *tmp2;
2188
2189         while (tmp) {
2190                 tmp2 = tmp->next;
2191                 SAFE_FREE(tmp);
2192                 tmp = tmp2;
2193         }
2194
2195         return;
2196 }
2197
2198 /****************************************************************************
2199  Find the correct RPC function to call for this request.
2200  If the pipe is authenticated then become the correct UNIX user
2201  before doing the call.
2202 ****************************************************************************/
2203
2204 BOOL api_pipe_request(pipes_struct *p)
2205 {
2206         BOOL ret = False;
2207         BOOL changed_user = False;
2208         PIPE_RPC_FNS *pipe_fns;
2209
2210         if (p->pipe_bound &&
2211                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2212                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2213                 if(!become_authenticated_pipe_user(p)) {
2214                         prs_mem_free(&p->out_data.rdata);
2215                         return False;
2216                 }
2217                 changed_user = True;
2218         }
2219
2220         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2221
2222         /* get the set of RPC functions for this context */
2223
2224         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2225
2226         if ( pipe_fns ) {
2227                 set_current_rpc_talloc(p->mem_ctx);
2228                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2229                 set_current_rpc_talloc(NULL);
2230         }
2231         else {
2232                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2233                         p->hdr_req.context_id, p->name));
2234         }
2235
2236         if (changed_user) {
2237                 unbecome_authenticated_pipe_user();
2238         }
2239
2240         return ret;
2241 }
2242
2243 /*******************************************************************
2244  Calls the underlying RPC function for a named pipe.
2245  ********************************************************************/
2246
2247 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
2248                 const struct api_struct *api_rpc_cmds, int n_cmds)
2249 {
2250         int fn_num;
2251         fstring name;
2252         uint32 offset1, offset2;
2253
2254         /* interpret the command */
2255         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2256
2257         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2258         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2259
2260         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2261                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2262                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2263                         break;
2264                 }
2265         }
2266
2267         if (fn_num == n_cmds) {
2268                 /*
2269                  * For an unknown RPC just return a fault PDU but
2270                  * return True to allow RPC's on the pipe to continue
2271                  * and not put the pipe into fault state. JRA.
2272                  */
2273                 DEBUG(4, ("unknown\n"));
2274                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2275                 return True;
2276         }
2277
2278         offset1 = prs_offset(&p->out_data.rdata);
2279
2280         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2281                 fn_num, api_rpc_cmds[fn_num].fn));
2282         /* do the actual command */
2283         if(!api_rpc_cmds[fn_num].fn(p)) {
2284                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2285                 prs_mem_free(&p->out_data.rdata);
2286                 return False;
2287         }
2288
2289         if (p->bad_handle_fault_state) {
2290                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2291                 p->bad_handle_fault_state = False;
2292                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2293                 return True;
2294         }
2295
2296         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2297         offset2 = prs_offset(&p->out_data.rdata);
2298         prs_set_offset(&p->out_data.rdata, offset1);
2299         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2300         prs_set_offset(&p->out_data.rdata, offset2);
2301
2302         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2303
2304         /* Check for buffer underflow in rpc parsing */
2305
2306         if ((DEBUGLEVEL >= 10) &&
2307             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2308                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2309                 char *data = SMB_MALLOC(data_len);
2310
2311                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2312                 if (data) {
2313                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2314                         SAFE_FREE(data);
2315                 }
2316
2317         }
2318
2319         return True;
2320 }
2321
2322 /*******************************************************************
2323 *******************************************************************/
2324
2325 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
2326 {
2327         struct api_struct *cmds = NULL;
2328         int               n_cmds = 0;
2329
2330         switch ( idx ) {
2331                 case PI_LSARPC:
2332                         lsa_get_pipe_fns( &cmds, &n_cmds );
2333                         break;
2334                 case PI_LSARPC_DS:
2335                         lsa_ds_get_pipe_fns( &cmds, &n_cmds );
2336                         break;
2337                 case PI_SAMR:
2338                         samr_get_pipe_fns( &cmds, &n_cmds );
2339                         break;
2340                 case PI_NETLOGON:
2341                         netlog_get_pipe_fns( &cmds, &n_cmds );
2342                         break;
2343                 case PI_SRVSVC:
2344                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
2345                         break;
2346                 case PI_WKSSVC:
2347                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
2348                         break;
2349                 case PI_WINREG:
2350                         reg_get_pipe_fns( &cmds, &n_cmds );
2351                         break;
2352                 case PI_SPOOLSS:
2353                         spoolss_get_pipe_fns( &cmds, &n_cmds );
2354                         break;
2355                 case PI_NETDFS:
2356                         netdfs_get_pipe_fns( &cmds, &n_cmds );
2357                         break;
2358                 case PI_SVCCTL:
2359                         svcctl_get_pipe_fns( &cmds, &n_cmds );
2360                         break;
2361                 case PI_EVENTLOG:
2362                         eventlog_get_pipe_fns( &cmds, &n_cmds );
2363                         break;
2364                 case PI_NTSVCS:
2365                         ntsvcs_get_pipe_fns( &cmds, &n_cmds );
2366                         break;
2367 #ifdef DEVELOPER
2368                 case PI_ECHO:
2369                         echo_get_pipe_fns( &cmds, &n_cmds );
2370                         break;
2371 #endif
2372                 default:
2373                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
2374         }
2375
2376         *fns = cmds;
2377         *n_fns = n_cmds;
2378
2379         return;
2380 }