source/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                  1997-1998,
   7  *  Copyright (C) Jeremy Allison                    1999,
   8  *  Copyright (C) Anthony Liguori                   2003.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 /*  this module apparently provides an implementation of DCE/RPC over a
  26  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  27  *  documentation are available (in on-line form) from the X-Open group.
  28  *
  29  *  this module should provide a level of abstraction between SMB
  30  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  31  *  data copies, and network traffic.
  32  *
  33  *  in this version, which takes a "let's learn what's going on and
  34  *  get something running" approach, there is additional network
  35  *  traffic generated, but the code should be easier to understand...
  36  *
  37  *  ... if you read the docs.  or stare at packets for weeks on end.
  38  *
  39  */
  40
  41 #include "includes.h"
  42
  43 #undef DBGC_CLASS
  44 #define DBGC_CLASS DBGC_RPC_SRV
  45
  46 /*************************************************************
  47  HACK Alert!
  48  We need to transfer the session key from one rpc bind to the
  49  next. This is the way the netlogon schannel works.
  50 **************************************************************/
  51 struct dcinfo last_dcinfo;
  52
  53 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  54 {
  55     unsigned char *hash = p->ntlmssp_hash;
  56     unsigned char index_i = hash[256];
  57     unsigned char index_j = hash[257];
  58     int ind;
  59
  60     for( ind = 0; ind < len; ind++) {
  61         unsigned char tc;
  62         unsigned char t;
  63
  64         index_i++;
  65         index_j += hash[index_i];
  66
  67         tc = hash[index_i];
  68         hash[index_i] = hash[index_j];
  69         hash[index_j] = tc;
  70
  71         t = hash[index_i] + hash[index_j];
  72         data[ind] = data[ind] ^ hash[t];
  73     }
  74
  75     hash[256] = index_i;
  76     hash[257] = index_j;
  77 }
  78
  79 /*******************************************************************
  80  Generate the next PDU to be returned from the data in p->rdata.
  81  We cheat here as this function doesn't handle the special auth
  82  footers of the authenticated bind response reply.
  83  ********************************************************************/
  84
  85 BOOL create_next_pdu(pipes_struct *p)
  86 {
  87         RPC_HDR_RESP hdr_resp;
  88         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
  89         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
  90         uint32 data_len;
  91         uint32 data_space_available;
  92         uint32 data_len_left;
  93         prs_struct outgoing_pdu;
  94         uint32 data_pos;
  95
  96         /*
  97          * If we're in the fault state, keep returning fault PDU's until
  98          * the pipe gets closed. JRA.
  99          */
 100
 101         if(p->fault_state) {
 102                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 103                 return True;
 104         }
 105
 106         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 107
 108         /* Change the incoming request header to a response. */
 109         p->hdr.pkt_type = RPC_RESPONSE;
 110
 111         /* Set up rpc header flags. */
 112         if (p->out_data.data_sent_length == 0)
 113                 p->hdr.flags = RPC_FLG_FIRST;
 114         else
 115                 p->hdr.flags = 0;
 116
 117         /*
 118          * Work out how much we can fit in a single PDU.
 119          */
 120
 121         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 122         if(p->ntlmssp_auth_validated)
 123                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 124
 125         if(p->netsec_auth_validated)
 126                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_CHK_LEN);
 127
 128         /*
 129          * The amount we send is the minimum of the available
 130          * space and the amount left to send.
 131          */
 132
 133         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 134
 135         /*
 136          * Ensure there really is data left to send.
 137          */
 138
 139         if(!data_len_left) {
 140                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 141                 return False;
 142         }
 143
 144         data_len = MIN(data_len_left, data_space_available);
 145
 146         /*
 147          * Set up the alloc hint. This should be the data left to
 148          * send.
 149          */
 150
 151         hdr_resp.alloc_hint = data_len_left;
 152
 153         /*
 154          * Set up the header lengths.
 155          */
 156
 157         if (p->ntlmssp_auth_validated) {
 158                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 159                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 160                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 161         } else if (p->netsec_auth_validated) {
 162                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 163                         RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_CHK_LEN;
 164                 p->hdr.auth_len = RPC_AUTH_NETSEC_CHK_LEN;
 165         } else {
 166                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 167                 p->hdr.auth_len = 0;
 168         }
 169
 170         /*
 171          * Work out if this PDU will be the last.
 172          */
 173
 174         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 175                 p->hdr.flags |= RPC_FLG_LAST;
 176
 177         /*
 178          * Init the parse struct to point at the outgoing
 179          * data.
 180          */
 181
 182         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 183         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 184
 185         /* Store the header in the data stream. */
 186         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 187                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 188                 prs_mem_free(&outgoing_pdu);
 189                 return False;
 190         }
 191
 192         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 193                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 194                 prs_mem_free(&outgoing_pdu);
 195                 return False;
 196         }
 197
 198         /* Store the current offset. */
 199         data_pos = prs_offset(&outgoing_pdu);
 200
 201         /* Copy the data into the PDU. */
 202
 203         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 204                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 205                 prs_mem_free(&outgoing_pdu);
 206                 return False;
 207         }
 208
 209         if (p->ntlmssp_auth_validated) {
 210                 uint32 crc32 = 0;
 211                 char *data;
 212
 213                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 214                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 215
 216                 /*
 217                  * Set data to point to where we copied the data into.
 218                  */
 219
 220                 data = prs_data_p(&outgoing_pdu) + data_pos;
 221
 222                 if (auth_seal) {
 223                         crc32 = crc32_calc_buffer(data, data_len);
 224                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 225                 }
 226
 227                 if (auth_seal || auth_verify) {
 228                         RPC_HDR_AUTH auth_info;
 229
 230                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL,
 231                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 232                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 233                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 234                                 prs_mem_free(&outgoing_pdu);
 235                                 return False;
 236                         }
 237                 }
 238
 239                 if (auth_verify) {
 240                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 241                         char *auth_data = prs_data_p(&outgoing_pdu);
 242
 243                         p->ntlmssp_seq_num++;
 244                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 245                                         crc32, p->ntlmssp_seq_num++);
 246                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 247                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 248                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 249                                 prs_mem_free(&outgoing_pdu);
 250                                 return False;
 251                         }
 252                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 253                 }
 254         }
 255
 256         if (p->netsec_auth_validated) {
 257                 char *data;
 258                 RPC_HDR_AUTH auth_info;
 259                 static const uchar netsec_sig[8] = NETSEC_SIGNATURE;
 260                 static const uchar nullbytes[8] = { 0,0,0,0,0,0,0,0 };
 261
 262                 RPC_AUTH_NETSEC_CHK verf;
 263                 prs_struct rverf;
 264                 prs_struct rauth;
 265
 266                 uchar sign[8];
 267
 268                 data = prs_data_p(&outgoing_pdu) + data_pos;
 269
 270                 init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, NETSEC_AUTH_LEVEL,
 271                                   RPC_HDR_AUTH_LEN, 1);
 272
 273                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 274                         DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 275                         prs_mem_free(&outgoing_pdu);
 276                         return False;
 277                 }
 278
 279                 prs_init(&rverf, 0, p->mem_ctx, MARSHALL);
 280                 prs_init(&rauth, 0, p->mem_ctx, MARSHALL);
 281
 282                 if ((p->netsec_auth.seq_num & 1) == 0) {
 283                         DEBUG(0,("SCHANNEL ERROR: seq_num must be odd in server! (seq_num=%d)\n",
 284                                         p->netsec_auth.seq_num));
 285                 }
 286
 287                 RSIVAL(sign, 0, p->netsec_auth.seq_num);
 288                 SIVAL(sign, 4, 0);
 289
 290                 init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, sign, nullbytes);
 291
 292                 netsec_encode(&p->netsec_auth, &verf, data, data_len);
 293
 294                 smb_io_rpc_auth_netsec_chk("", &verf, &outgoing_pdu, 0);
 295
 296                 p->netsec_auth.seq_num++;
 297         }
 298
 299         /*
 300          * Setup the counts for this PDU.
 301          */
 302
 303         p->out_data.data_sent_length += data_len;
 304         p->out_data.current_pdu_len = p->hdr.frag_len;
 305         p->out_data.current_pdu_sent = 0;
 306
 307         prs_mem_free(&outgoing_pdu);
 308         return True;
 309 }
 310
 311 /*******************************************************************
 312  Process an NTLMSSP authentication response.
 313  If this function succeeds, the user has been authenticated
 314  and their domain, name and calling workstation stored in
 315  the pipe struct.
 316  The initial challenge is stored in p->challenge.
 317  *******************************************************************/
 318
 319 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 320 {
 321         uchar lm_owf[24];
 322         uchar nt_owf[128];
 323         int nt_pw_len;
 324         int lm_pw_len;
 325         fstring user_name;
 326         fstring domain;
 327         fstring wks;
 328
 329         NTSTATUS nt_status;
 330
 331         struct auth_context *auth_context = NULL;
 332         auth_usersupplied_info *user_info = NULL;
 333         auth_serversupplied_info *server_info = NULL;
 334
 335         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 336
 337         memset(p->user_name, '\0', sizeof(p->user_name));
 338         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 339         memset(p->domain, '\0', sizeof(p->domain));
 340         memset(p->wks, '\0', sizeof(p->wks));
 341
 342         /* Set up for non-authenticated user. */
 343         delete_nt_token(&p->pipe_user.nt_user_token);
 344         p->pipe_user.ngroups = 0;
 345         SAFE_FREE( p->pipe_user.groups);
 346
 347         /*
 348          * Setup an empty password for a guest user.
 349          */
 350
 351         /*
 352          * We always negotiate UNICODE.
 353          */
 354
 355         if (p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_UNICODE) {
 356                 rpcstr_pull(user_name, ntlmssp_resp->user, sizeof(fstring), ntlmssp_resp->hdr_usr.str_str_len*2, 0 );
 357                 rpcstr_pull(domain, ntlmssp_resp->domain, sizeof(fstring), ntlmssp_resp->hdr_domain.str_str_len*2, 0);
 358                 rpcstr_pull(wks, ntlmssp_resp->wks, sizeof(fstring), ntlmssp_resp->hdr_wks.str_str_len*2, 0);
 359         } else {
 360                 pull_ascii_fstring(user_name, ntlmssp_resp->user);
 361                 pull_ascii_fstring(domain, ntlmssp_resp->domain);
 362                 pull_ascii_fstring(wks, ntlmssp_resp->wks);
 363         }
 364
 365         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 366
 367         nt_pw_len = MIN(sizeof(nt_owf), ntlmssp_resp->hdr_nt_resp.str_str_len);
 368         lm_pw_len = MIN(sizeof(lm_owf), ntlmssp_resp->hdr_lm_resp.str_str_len);
 369
 370         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 371         memcpy(nt_owf, ntlmssp_resp->nt_resp, nt_pw_len);
 372
 373 #ifdef DEBUG_PASSWORD
 374         DEBUG(100,("lm, nt owfs, chal\n"));
 375         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 376         dump_data(100, (char *)nt_owf, nt_pw_len);
 377         dump_data(100, (char *)p->challenge, 8);
 378 #endif
 379
 380         /*
 381          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 382          */
 383
 384         if (*user_name) {
 385
 386                 /*
 387                  * Do the length checking only if user is not NULL.
 388                  */
 389
 390                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 391                         return False;
 392                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 393                         return False;
 394                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 395                         return False;
 396                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 397                         return False;
 398                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 399                         return False;
 400
 401         }
 402
 403         make_auth_context_fixed(&auth_context, (uchar*)p->challenge);
 404
 405         if (!make_user_info_netlogon_network(&user_info,
 406                                              user_name, domain, wks,
 407                                              lm_owf, lm_pw_len,
 408                                              nt_owf, nt_pw_len)) {
 409                 DEBUG(0,("make_user_info_netlogon_network failed!  Failing authenticaion.\n"));
 410                 return False;
 411         }
 412
 413         nt_status = auth_context->check_ntlm_password(auth_context, user_info, &server_info);
 414
 415         (auth_context->free)(&auth_context);
 416         free_user_info(&user_info);
 417
 418         p->ntlmssp_auth_validated = NT_STATUS_IS_OK(nt_status);
 419
 420         if (!p->ntlmssp_auth_validated) {
 421                 DEBUG(1,("api_pipe_ntlmssp_verify: User [%s]\\[%s] from machine %s \
 422 failed authentication on named pipe %s.\n", domain, user_name, wks, p->name ));
 423                 free_server_info(&server_info);
 424                 return False;
 425         }
 426
 427         /*
 428          * Set up the sign/seal data.
 429          */
 430
 431         {
 432                 uchar p24[24];
 433                 NTLMSSPOWFencrypt(server_info->first_8_lm_hash, lm_owf, p24);
 434                 {
 435                         unsigned char j = 0;
 436                         int ind;
 437
 438                         unsigned char k2[8];
 439
 440                         memcpy(k2, p24, 5);
 441                         k2[5] = 0xe5;
 442                         k2[6] = 0x38;
 443                         k2[7] = 0xb0;
 444
 445                         for (ind = 0; ind < 256; ind++)
 446                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 447
 448                         for( ind = 0; ind < 256; ind++) {
 449                                 unsigned char tc;
 450
 451                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 452
 453                                 tc = p->ntlmssp_hash[ind];
 454                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 455                                 p->ntlmssp_hash[j] = tc;
 456                         }
 457
 458                         p->ntlmssp_hash[256] = 0;
 459                         p->ntlmssp_hash[257] = 0;
 460                 }
 461 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 462                 p->ntlmssp_seq_num = 0;
 463
 464         }
 465
 466         fstrcpy(p->user_name, user_name);
 467         fstrcpy(p->pipe_user_name, server_info->unix_name);
 468         fstrcpy(p->domain, domain);
 469         fstrcpy(p->wks, wks);
 470
 471         /*
 472          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 473          */
 474
 475         memcpy(p->session_key, server_info->session_key, sizeof(p->session_key));
 476
 477         p->pipe_user.uid = server_info->uid;
 478         p->pipe_user.gid = server_info->gid;
 479
 480         p->pipe_user.ngroups = server_info->n_groups;
 481         if (p->pipe_user.ngroups) {
 482                 if (!(p->pipe_user.groups = memdup(server_info->groups, sizeof(gid_t) * p->pipe_user.ngroups))) {
 483                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 484                         free_server_info(&server_info);
 485                         return False;
 486                 }
 487         }
 488
 489         if (server_info->ptok)
 490                 p->pipe_user.nt_user_token = dup_nt_token(server_info->ptok);
 491         else {
 492                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 493                 p->pipe_user.nt_user_token = NULL;
 494                 free_server_info(&server_info);
 495                 return False;
 496         }
 497
 498         p->ntlmssp_auth_validated = True;
 499
 500         free_server_info(&server_info);
 501         return True;
 502 }
 503
 504 /*******************************************************************
 505  The switch table for the pipe names and the functions to handle them.
 506  *******************************************************************/
 507
 508 struct rpc_table
 509 {
 510   struct
 511   {
 512     const char *clnt;
 513     const char *srv;
 514   } pipe;
 515   struct api_struct *cmds;
 516   int n_cmds;
 517 };
 518
 519 static struct rpc_table *rpc_lookup;
 520 static int rpc_lookup_size;
 521
 522 /*******************************************************************
 523  This is the client reply to our challenge for an authenticated
 524  bind request. The challenge we sent is in p->challenge.
 525 *******************************************************************/
 526
 527 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 528 {
 529         RPC_HDR_AUTHA autha_info;
 530         RPC_AUTH_VERIFIER auth_verifier;
 531         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 532
 533         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 534
 535         if (p->hdr.auth_len == 0) {
 536                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 537                 return False;
 538         }
 539
 540         /*
 541          * Decode the authentication verifier response.
 542          */
 543
 544         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 545                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 546                 return False;
 547         }
 548
 549         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != NTLMSSP_AUTH_LEVEL) {
 550                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 551                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 552                 return False;
 553         }
 554
 555         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 556                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 557                 return False;
 558         }
 559
 560         /*
 561          * Ensure this is a NTLMSSP_AUTH packet type.
 562          */
 563
 564         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 565                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 566                 return False;
 567         }
 568
 569         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 570                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 571                 return False;
 572         }
 573
 574         /*
 575          * The following call actually checks the challenge/response data.
 576          * for correctness against the given DOMAIN\user name.
 577          */
 578
 579         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 580                 return False;
 581
 582         p->pipe_bound = True
 583 ;
 584         return True;
 585 }
 586
 587 /*******************************************************************
 588  Marshall a bind_nak pdu.
 589 *******************************************************************/
 590
 591 static BOOL setup_bind_nak(pipes_struct *p)
 592 {
 593         prs_struct outgoing_rpc;
 594         RPC_HDR nak_hdr;
 595         uint16 zero = 0;
 596
 597         /* Free any memory in the current return data buffer. */
 598         prs_mem_free(&p->out_data.rdata);
 599
 600         /*
 601          * Marshall directly into the outgoing PDU space. We
 602          * must do this as we need to set to the bind response
 603          * header and are never sending more than one PDU here.
 604          */
 605
 606         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 607         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 608
 609
 610         /*
 611          * Initialize a bind_nak header.
 612          */
 613
 614         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 615             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 616
 617         /*
 618          * Marshall the header into the outgoing PDU.
 619          */
 620
 621         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 622                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 623                 prs_mem_free(&outgoing_rpc);
 624                 return False;
 625         }
 626
 627         /*
 628          * Now add the reject reason.
 629          */
 630
 631         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 632                 prs_mem_free(&outgoing_rpc);
 633         return False;
 634         }
 635
 636         p->out_data.data_sent_length = 0;
 637         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 638         p->out_data.current_pdu_sent = 0;
 639
 640         p->pipe_bound = False;
 641
 642         return True;
 643 }
 644
 645 /*******************************************************************
 646  Marshall a fault pdu.
 647 *******************************************************************/
 648
 649 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 650 {
 651         prs_struct outgoing_pdu;
 652         RPC_HDR fault_hdr;
 653         RPC_HDR_RESP hdr_resp;
 654         RPC_HDR_FAULT fault_resp;
 655
 656         /* Free any memory in the current return data buffer. */
 657         prs_mem_free(&p->out_data.rdata);
 658
 659         /*
 660          * Marshall directly into the outgoing PDU space. We
 661          * must do this as we need to set to the bind response
 662          * header and are never sending more than one PDU here.
 663          */
 664
 665         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 666         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 667
 668         /*
 669          * Initialize a fault header.
 670          */
 671
 672         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 673             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 674
 675         /*
 676          * Initialize the HDR_RESP and FAULT parts of the PDU.
 677          */
 678
 679         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 680
 681         fault_resp.status = status;
 682         fault_resp.reserved = 0;
 683
 684         /*
 685          * Marshall the header into the outgoing PDU.
 686          */
 687
 688         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 689                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 690                 prs_mem_free(&outgoing_pdu);
 691                 return False;
 692         }
 693
 694         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 695                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 696                 prs_mem_free(&outgoing_pdu);
 697                 return False;
 698         }
 699
 700         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 701                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 702                 prs_mem_free(&outgoing_pdu);
 703                 return False;
 704         }
 705
 706         p->out_data.data_sent_length = 0;
 707         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 708         p->out_data.current_pdu_sent = 0;
 709
 710         prs_mem_free(&outgoing_pdu);
 711         return True;
 712 }
 713
 714 /*******************************************************************
 715  Ensure a bind request has the correct abstract & transfer interface.
 716  Used to reject unknown binds from Win2k.
 717 *******************************************************************/
 718
 719 BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract,
 720                                         RPC_IFACE* transfer)
 721 {
 722         extern struct pipe_id_info pipe_names[];
 723         int i=0;
 724         fstring pname;
 725         fstrcpy(pname,"\\PIPE\\");
 726         fstrcat(pname,pipe_name);
 727
 728         DEBUG(3,("check_bind_req for %s\n", pname));
 729
 730 #ifndef SUPPORT_NEW_LSARPC_UUID
 731
 732         /* check for the first pipe matching the name */
 733
 734         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 735                 if ( strequal(pipe_names[i].client_pipe, pname) )
 736                         break;
 737         }
 738 #else
 739         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 740
 741         for ( i=0; pipe_names[i].client_pipe; i++ )
 742         {
 743                 if ( strequal(pipe_names[i].client_pipe, pname)
 744                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 745                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) == 0)
 746                         && (transfer->version == pipe_names[i].trans_syntax.version)
 747                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) == 0) )
 748                 {
 749                         break;
 750                 }
 751         }
 752 #endif
 753
 754         if(pipe_names[i].client_pipe == NULL)
 755                 return False;
 756
 757 #ifndef SUPPORT_NEW_LSARPC_UUID
 758         /* check the abstract interface */
 759         if ( (abstract->version != pipe_names[i].abstr_syntax.version)
 760                 || (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) != 0) )
 761         {
 762                 return False;
 763         }
 764
 765         /* check the transfer interface */
 766         if ( (transfer->version != pipe_names[i].trans_syntax.version)
 767                 || (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) != 0) )
 768         {
 769                 return False;
 770         }
 771 #endif
 772         return True;
 773 }
 774
 775 /*******************************************************************
 776  Register commands to an RPC pipe
 777 *******************************************************************/
 778 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
 779 {
 780         struct rpc_table *rpc_entry;
 781
 782         if (!clnt || !srv || !cmds) {
 783                 return NT_STATUS_INVALID_PARAMETER;
 784         }
 785
 786         if (version != SMB_RPC_INTERFACE_VERSION) {
 787                 DEBUG(0,("Can't register rpc commands!\n"
 788                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
 789                          ", while this version of samba uses version %d!\n",
 790                          version,SMB_RPC_INTERFACE_VERSION));
 791                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 792         }
 793
 794         /* TODO:
 795          *
 796          * we still need to make sure that don't register the same commands twice!!!
 797          *
 798          * --metze
 799          */
 800
 801         /* We use a temporary variable because this call can fail and
 802            rpc_lookup will still be valid afterwards.  It could then succeed if
 803            called again later */
 804         rpc_entry = realloc(rpc_lookup,
 805                             ++rpc_lookup_size*sizeof(struct rpc_table));
 806         if (NULL == rpc_entry) {
 807                 rpc_lookup_size--;
 808                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
 809                 return NT_STATUS_NO_MEMORY;
 810         } else {
 811                 rpc_lookup = rpc_entry;
 812         }
 813
 814         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
 815         ZERO_STRUCTP(rpc_entry);
 816         rpc_entry->pipe.clnt = strdup(clnt);
 817         rpc_entry->pipe.srv = strdup(srv);
 818         rpc_entry->cmds = realloc(rpc_entry->cmds,
 819                                   (rpc_entry->n_cmds + size) *
 820                                   sizeof(struct api_struct));
 821         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds,
 822                size * sizeof(struct api_struct));
 823         rpc_entry->n_cmds += size;
 824
 825         return NT_STATUS_OK;
 826 }
 827
 828 /*******************************************************************
 829  Respond to a pipe bind request.
 830 *******************************************************************/
 831
 832 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 833 {
 834         RPC_HDR_BA hdr_ba;
 835         RPC_HDR_RB hdr_rb;
 836         RPC_HDR_AUTH auth_info;
 837         uint16 assoc_gid;
 838         fstring ack_pipe_name;
 839         prs_struct out_hdr_ba;
 840         prs_struct out_auth;
 841         prs_struct outgoing_rpc;
 842         int i = 0;
 843         int auth_len = 0;
 844         enum RPC_PKT_TYPE reply_pkt_type;
 845
 846         p->ntlmssp_auth_requested = False;
 847         p->netsec_auth_validated = False;
 848
 849         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 850
 851         /*
 852          * Try and find the correct pipe name to ensure
 853          * that this is a pipe name we support.
 854          */
 855
 856
 857         for (i = 0; i < rpc_lookup_size; i++) {
 858                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 859                   DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 860                             rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 861                   fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 862                   break;
 863                 }
 864         }
 865
 866         if (i == rpc_lookup_size) {
 867                                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
 868                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 869                                 p->name ));
 870                        if(!setup_bind_nak(p))
 871                                return False;
 872                        return True;
 873                 }
 874
 875                 for (i = 0; i < rpc_lookup_size; i++) {
 876                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 877                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 878                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 879                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 880                                break;
 881                        }
 882                 }
 883
 884                                 if (i == rpc_lookup_size) {
 885                                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
 886                                         return False;
 887                                 }
 888         }
 889
 890         /* decode the bind request */
 891         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 892                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 893                 return False;
 894         }
 895
 896         /*
 897          * Check if this is an authenticated request.
 898          */
 899
 900         if (p->hdr.auth_len != 0) {
 901                 RPC_AUTH_VERIFIER auth_verifier;
 902                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 903
 904                 /*
 905                  * Decode the authentication verifier.
 906                  */
 907
 908                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 909                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 910                         return False;
 911                 }
 912
 913                 if(auth_info.auth_type == NTLMSSP_AUTH_TYPE) {
 914
 915                         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 916                                 DEBUG(0,("api_pipe_bind_req: unable to "
 917                                          "unmarshall RPC_HDR_AUTH struct.\n"));
 918                                 return False;
 919                         }
 920
 921                         if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 922                                 DEBUG(0,("api_pipe_bind_req: "
 923                                          "auth_verifier.signature != NTLMSSP\n"));
 924                                 return False;
 925                         }
 926
 927                         if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 928                                 DEBUG(0,("api_pipe_bind_req: "
 929                                          "auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 930                                          auth_verifier.msg_type));
 931                                 return False;
 932                         }
 933
 934                         if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 935                                 DEBUG(0,("api_pipe_bind_req: "
 936                                          "Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 937                                 return False;
 938                         }
 939
 940                         p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 941                         p->ntlmssp_auth_requested = True;
 942
 943                 } else if (auth_info.auth_type == NETSEC_AUTH_TYPE) {
 944
 945                         RPC_AUTH_NETSEC_NEG neg;
 946                         struct netsec_auth_struct *a = &(p->netsec_auth);
 947
 948                         if (!smb_io_rpc_auth_netsec_neg("", &neg, rpc_in_p, 0)) {
 949                                 DEBUG(0,("api_pipe_bind_req: "
 950                                          "Could not unmarshal SCHANNEL auth neg\n"));
 951                                 return False;
 952                         }
 953
 954                         p->netsec_auth_validated = True;
 955
 956                         memset(a->sess_key, 0, sizeof(a->sess_key));
 957                         memcpy(a->sess_key, last_dcinfo.sess_key, sizeof(last_dcinfo.sess_key));
 958
 959                         a->seq_num = 0;
 960
 961                         DEBUG(10,("schannel auth: domain [%s] myname [%s]\n",
 962                                   neg.domain, neg.myname));
 963
 964                 } else {
 965                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 966                                  auth_info.auth_type ));
 967                         return False;
 968                 }
 969         }
 970
 971         switch(p->hdr.pkt_type) {
 972                 case RPC_BIND:
 973                         /* name has to be \PIPE\xxxxx */
 974                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 975                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 976                         reply_pkt_type = RPC_BINDACK;
 977                         break;
 978                 case RPC_ALTCONT:
 979                         /* secondary address CAN be NULL
 980                          * as the specs say it's ignored.
 981                          * It MUST NULL to have the spoolss working.
 982                          */
 983                         fstrcpy(ack_pipe_name,"");
 984                         reply_pkt_type = RPC_ALTCONTRESP;
 985                         break;
 986                 default:
 987                         return False;
 988         }
 989
 990         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 991
 992         /*
 993          * Marshall directly into the outgoing PDU space. We
 994          * must do this as we need to set to the bind response
 995          * header and are never sending more than one PDU here.
 996          */
 997
 998         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 999         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1000
1001         /*
1002          * Setup the memory to marshall the ba header, and the
1003          * auth footers.
1004          */
1005
1006         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1007                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1008                 prs_mem_free(&outgoing_rpc);
1009                 return False;
1010         }
1011
1012         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1013                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
1014                 prs_mem_free(&outgoing_rpc);
1015                 prs_mem_free(&out_hdr_ba);
1016                 return False;
1017         }
1018
1019         if (p->ntlmssp_auth_requested)
1020                 assoc_gid = 0x7a77;
1021         else
1022                 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1023
1024         /*
1025          * Create the bind response struct.
1026          */
1027
1028         /* If the requested abstract synt uuid doesn't match our client pipe,
1029                 reject the bind_ack & set the transfer interface synt to all 0's,
1030                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1031                 unknown to NT4)
1032                 Needed when adding entries to a DACL from NT5 - SK */
1033
1034         if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) {
1035                 init_rpc_hdr_ba(&hdr_ba,
1036                         MAX_PDU_FRAG_LEN,
1037                         MAX_PDU_FRAG_LEN,
1038                         assoc_gid,
1039                         ack_pipe_name,
1040                         0x1, 0x0, 0x0,
1041                         &hdr_rb.transfer);
1042         } else {
1043                 RPC_IFACE null_interface;
1044                 ZERO_STRUCT(null_interface);
1045                 /* Rejection reason: abstract syntax not supported */
1046                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
1047                                         MAX_PDU_FRAG_LEN, assoc_gid,
1048                                         ack_pipe_name, 0x1, 0x2, 0x1,
1049                                         &null_interface);
1050         }
1051
1052         /*
1053          * and marshall it.
1054          */
1055
1056         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1057                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1058                 goto err_exit;
1059         }
1060
1061         /*
1062          * Now the authentication.
1063          */
1064
1065         if (p->ntlmssp_auth_requested) {
1066                 RPC_AUTH_VERIFIER auth_verifier;
1067                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
1068
1069                 generate_random_buffer(p->challenge, 8, False);
1070
1071                 /*** Authentication info ***/
1072
1073                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
1074                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
1075                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
1076                         goto err_exit;
1077                 }
1078
1079                 /*** NTLMSSP verifier ***/
1080
1081                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
1082                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
1083                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1084                         goto err_exit;
1085                 }
1086
1087                 /* NTLMSSP challenge ***/
1088
1089                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
1090                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
1091                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
1092                         goto err_exit;
1093                 }
1094
1095                 /* Auth len in the rpc header doesn't include auth_header. */
1096                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1097         }
1098
1099         if (p->netsec_auth_validated) {
1100                 RPC_AUTH_VERIFIER auth_verifier;
1101                 uint32 flags;
1102
1103                 /* The client opens a second RPC NETLOGON pipe without
1104                    doing a auth2. The credentials for the schannel are
1105                    re-used from the auth2 the client did before. */
1106                 p->dc = last_dcinfo;
1107
1108                 init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, NETSEC_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
1109                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
1110                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
1111                         goto err_exit;
1112                 }
1113
1114                 /*** NETSEC verifier ***/
1115
1116                 init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1117                 if(!smb_io_rpc_netsec_verifier("", &auth_verifier, &out_auth, 0)) {
1118                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1119                         goto err_exit;
1120                 }
1121
1122                 prs_align(&out_auth);
1123
1124                 flags = 5;
1125                 if(!prs_uint32("flags ", &out_auth, 0, &flags))
1126                         goto err_exit;
1127
1128                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1129         }
1130
1131         /*
1132          * Create the header, now we know the length.
1133          */
1134
1135         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
1136                         p->hdr.call_id,
1137                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1138                         auth_len);
1139
1140         /*
1141          * Marshall the header into the outgoing PDU.
1142          */
1143
1144         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1145                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1146                 goto err_exit;
1147         }
1148
1149         /*
1150          * Now add the RPC_HDR_BA and any auth needed.
1151          */
1152
1153         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1154                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1155                 goto err_exit;
1156         }
1157
1158         if((p->ntlmssp_auth_requested|p->netsec_auth_validated) &&
1159            !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1160                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1161                 goto err_exit;
1162         }
1163
1164         if(!p->ntlmssp_auth_requested)
1165                 p->pipe_bound = True;
1166
1167         /*
1168          * Setup the lengths for the initial reply.
1169          */
1170
1171         p->out_data.data_sent_length = 0;
1172         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1173         p->out_data.current_pdu_sent = 0;
1174
1175         prs_mem_free(&out_hdr_ba);
1176         prs_mem_free(&out_auth);
1177
1178         return True;
1179
1180   err_exit:
1181
1182         prs_mem_free(&outgoing_rpc);
1183         prs_mem_free(&out_hdr_ba);
1184         prs_mem_free(&out_auth);
1185         return False;
1186 }
1187
1188 /****************************************************************************
1189  Deal with sign & seal processing on an RPC request.
1190 ****************************************************************************/
1191
1192 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1193 {
1194         /*
1195          * We always negotiate the following two bits....
1196          */
1197         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
1198         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
1199         int data_len;
1200         int auth_len;
1201         uint32 old_offset;
1202         uint32 crc32 = 0;
1203
1204         auth_len = p->hdr.auth_len;
1205
1206         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1207                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1208                 return False;
1209         }
1210
1211         /*
1212          * The following is that length of the data we must verify or unseal.
1213          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1214          * preceeding the auth_data.
1215          */
1216
1217         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1218                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1219
1220         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1221                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1222
1223         if (auth_seal) {
1224                 /*
1225                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1226                  * has already been consumed.
1227                  */
1228                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1229                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1230                 crc32 = crc32_calc_buffer(data, data_len);
1231         }
1232
1233         old_offset = prs_offset(rpc_in);
1234
1235         if (auth_seal || auth_verify) {
1236                 RPC_HDR_AUTH auth_info;
1237
1238                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1239                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1240                                 (unsigned int)old_offset + data_len ));
1241                         return False;
1242                 }
1243
1244                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1245                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1246                         return False;
1247                 }
1248         }
1249
1250         if (auth_verify) {
1251                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1252                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1253
1254                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1255
1256                 /*
1257                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1258                  * incoming buffer.
1259                  */
1260                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1261                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1262                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1263                         return False;
1264                 }
1265
1266                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1267                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1268                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1269                         return False;
1270                 }
1271
1272                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1273                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1274                         return False;
1275                 }
1276         }
1277
1278         /*
1279          * Return the current pointer to the data offset.
1280          */
1281
1282         if(!prs_set_offset(rpc_in, old_offset)) {
1283                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1284                         (unsigned int)old_offset ));
1285                 return False;
1286         }
1287
1288         return True;
1289 }
1290
1291 /****************************************************************************
1292  Deal with schannel processing on an RPC request.
1293 ****************************************************************************/
1294 BOOL api_pipe_netsec_process(pipes_struct *p, prs_struct *rpc_in)
1295 {
1296         /*
1297          * We always negotiate the following two bits....
1298          */
1299         int data_len;
1300         int auth_len;
1301         uint32 old_offset;
1302         RPC_HDR_AUTH auth_info;
1303         RPC_AUTH_NETSEC_CHK netsec_chk;
1304
1305
1306         auth_len = p->hdr.auth_len;
1307
1308         if (auth_len != RPC_AUTH_NETSEC_CHK_LEN) {
1309                 DEBUG(0,("Incorrect auth_len %d.\n", auth_len ));
1310                 return False;
1311         }
1312
1313         /*
1314          * The following is that length of the data we must verify or unseal.
1315          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1316          * preceeding the auth_data.
1317          */
1318
1319         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1320                 RPC_HDR_AUTH_LEN - auth_len;
1321
1322         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
1323
1324         old_offset = prs_offset(rpc_in);
1325
1326         if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1327                 DEBUG(0,("cannot move offset to %u.\n",
1328                          (unsigned int)old_offset + data_len ));
1329                 return False;
1330         }
1331
1332         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1333                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
1334                 return False;
1335         }
1336
1337         if ((auth_info.auth_type != NETSEC_AUTH_TYPE) ||
1338             (auth_info.auth_level != NETSEC_AUTH_LEVEL)) {
1339                 DEBUG(0,("Invalid auth info %d or level %d on schannel\n",
1340                          auth_info.auth_type, auth_info.auth_level));
1341                 return False;
1342         }
1343
1344         if(!smb_io_rpc_auth_netsec_chk("", &netsec_chk, rpc_in, 0)) {
1345                 DEBUG(0,("failed to unmarshal RPC_AUTH_NETSEC_CHK.\n"));
1346                 return False;
1347         }
1348
1349         if (!netsec_decode(&p->netsec_auth, &netsec_chk,
1350                            prs_data_p(rpc_in)+old_offset, data_len)) {
1351                 DEBUG(0,("failed to decode PDU\n"));
1352                 return False;
1353         }
1354
1355         /*
1356          * Return the current pointer to the data offset.
1357          */
1358
1359         if(!prs_set_offset(rpc_in, old_offset)) {
1360                 DEBUG(0,("failed to set offset back to %u\n",
1361                          (unsigned int)old_offset ));
1362                 return False;
1363         }
1364
1365         /* The sequence number gets incremented on both send and receive. */
1366         p->netsec_auth.seq_num++;
1367
1368         return True;
1369 }
1370
1371 /****************************************************************************
1372  Return a user struct for a pipe user.
1373 ****************************************************************************/
1374
1375 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
1376 {
1377         if (p->ntlmssp_auth_validated) {
1378                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
1379         } else {
1380                 extern struct current_user current_user;
1381                 memcpy(user, &current_user, sizeof(struct current_user));
1382         }
1383
1384         return user;
1385 }
1386
1387 /****************************************************************************
1388  Find the correct RPC function to call for this request.
1389  If the pipe is authenticated then become the correct UNIX user
1390  before doing the call.
1391 ****************************************************************************/
1392
1393 BOOL api_pipe_request(pipes_struct *p)
1394 {
1395         int i = 0;
1396         BOOL ret = False;
1397
1398         if (p->ntlmssp_auth_validated) {
1399
1400                 if(!become_authenticated_pipe_user(p)) {
1401                         prs_mem_free(&p->out_data.rdata);
1402                         return False;
1403                 }
1404         }
1405
1406         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
1407
1408         for (i = 0; i < rpc_lookup_size; i++) {
1409                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1410                         DEBUG(3,("Doing \\PIPE\\%s\n",
1411                                  rpc_lookup[i].pipe.clnt));
1412                         set_current_rpc_talloc(p->mem_ctx);
1413                         ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt,
1414                                          rpc_lookup[i].cmds,
1415                                          rpc_lookup[i].n_cmds);
1416                         set_current_rpc_talloc(NULL);
1417                         break;
1418                 }
1419         }
1420
1421
1422         if (i == rpc_lookup_size) {
1423                 smb_probe_module("rpc", p->name);
1424
1425                 for (i = 0; i < rpc_lookup_size; i++) {
1426                         if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1427                                 DEBUG(3,("Doing \\PIPE\\%s\n",
1428                                          rpc_lookup[i].pipe.clnt));
1429                                 set_current_rpc_talloc(p->mem_ctx);
1430                                 ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt,
1431                                                  rpc_lookup[i].cmds,
1432                                                  rpc_lookup[i].n_cmds);
1433                                 set_current_rpc_talloc(NULL);
1434                                 break;
1435                         }
1436                 }
1437         }
1438
1439         if(p->ntlmssp_auth_validated)
1440                 unbecome_authenticated_pipe_user();
1441
1442         return ret;
1443 }
1444
1445 /*******************************************************************
1446  Calls the underlying RPC function for a named pipe.
1447  ********************************************************************/
1448
1449 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
1450                 const struct api_struct *api_rpc_cmds, int n_cmds)
1451 {
1452         int fn_num;
1453         fstring name;
1454         uint32 offset1, offset2;
1455
1456         /* interpret the command */
1457         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1458
1459         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
1460         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1461
1462         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1463                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1464                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1465                         break;
1466                 }
1467         }
1468
1469         if (fn_num == n_cmds) {
1470                 /*
1471                  * For an unknown RPC just return a fault PDU but
1472                  * return True to allow RPC's on the pipe to continue
1473                  * and not put the pipe into fault state. JRA.
1474                  */
1475                 DEBUG(4, ("unknown\n"));
1476                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
1477                 return True;
1478         }
1479
1480         offset1 = prs_offset(&p->out_data.rdata);
1481
1482         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1483                 fn_num, api_rpc_cmds[fn_num].fn));
1484         /* do the actual command */
1485         if(!api_rpc_cmds[fn_num].fn(p)) {
1486                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
1487                 prs_mem_free(&p->out_data.rdata);
1488                 return False;
1489         }
1490
1491         if (p->bad_handle_fault_state) {
1492                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1493                 p->bad_handle_fault_state = False;
1494                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
1495                 return True;
1496         }
1497
1498         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
1499         offset2 = prs_offset(&p->out_data.rdata);
1500         prs_set_offset(&p->out_data.rdata, offset1);
1501         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1502         prs_set_offset(&p->out_data.rdata, offset2);
1503
1504         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1505
1506         /* Check for buffer underflow in rpc parsing */
1507
1508         if ((DEBUGLEVEL >= 10) &&
1509             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
1510                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
1511                 char *data;
1512
1513                 data = malloc(data_len);
1514
1515                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1516                 if (data) {
1517                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
1518                         SAFE_FREE(data);
1519                 }
1520
1521         }
1522
1523         return True;
1524 }