source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "../librpc/gen_ndr/ndr_schannel.h"
  32 #include "../libcli/auth/schannel.h"
  33 #include "../libcli/auth/spnego.h"
  34
  35 extern struct current_user current_user;
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_RPC_SRV
  39
  40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  41 {
  42         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  43
  44         if (a) {
  45                 auth_ntlmssp_end(&a);
  46         }
  47         auth->a_u.auth_ntlmssp_state = NULL;
  48 }
  49
  50 static DATA_BLOB generic_session_key(void)
  51 {
  52         return data_blob("SystemLibraryDTC", 16);
  53 }
  54
  55 /*******************************************************************
  56  Generate the next PDU to be returned from the data in p->rdata.
  57  Handle NTLMSSP.
  58  ********************************************************************/
  59
  60 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  61 {
  62         RPC_HDR_RESP hdr_resp;
  63         uint32 ss_padding_len = 0;
  64         uint32 data_space_available;
  65         uint32 data_len_left;
  66         uint32 data_len;
  67         NTSTATUS status;
  68         DATA_BLOB auth_blob;
  69         RPC_HDR_AUTH auth_info;
  70         uint8 auth_type, auth_level;
  71         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  72
  73         /*
  74          * If we're in the fault state, keep returning fault PDU's until
  75          * the pipe gets closed. JRA.
  76          */
  77
  78         if(p->fault_state) {
  79                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  80                 return True;
  81         }
  82
  83         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  84
  85         /* Change the incoming request header to a response. */
  86         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
  87
  88         /* Set up rpc header flags. */
  89         if (p->out_data.data_sent_length == 0) {
  90                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
  91         } else {
  92                 p->hdr.flags = 0;
  93         }
  94
  95         /*
  96          * Work out how much we can fit in a single PDU.
  97          */
  98
  99         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 100
 101         /*
 102          * Ensure there really is data left to send.
 103          */
 104
 105         if(!data_len_left) {
 106                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 107                 return False;
 108         }
 109
 110         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 111                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 112
 113         /*
 114          * The amount we send is the minimum of the available
 115          * space and the amount left to send.
 116          */
 117
 118         data_len = MIN(data_len_left, data_space_available);
 119
 120         /*
 121          * Set up the alloc hint. This should be the data left to
 122          * send.
 123          */
 124
 125         hdr_resp.alloc_hint = data_len_left;
 126
 127         /*
 128          * Work out if this PDU will be the last.
 129          */
 130
 131         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 132                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 133                 if (data_len_left % 8) {
 134                         ss_padding_len = 8 - (data_len_left % 8);
 135                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 136                                 ss_padding_len ));
 137                 }
 138         }
 139
 140         /*
 141          * Set up the header lengths.
 142          */
 143
 144         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 145                         data_len + ss_padding_len +
 146                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 147         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 148
 149
 150         /*
 151          * Init the parse struct to point at the outgoing
 152          * data.
 153          */
 154
 155         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 156
 157         /* Store the header in the data stream. */
 158         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 159                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 160                 prs_mem_free(&p->out_data.frag);
 161                 return False;
 162         }
 163
 164         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 165                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 166                 prs_mem_free(&p->out_data.frag);
 167                 return False;
 168         }
 169
 170         /* Copy the data into the PDU. */
 171
 172         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 173                                      p->out_data.data_sent_length, data_len)) {
 174                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 175                 prs_mem_free(&p->out_data.frag);
 176                 return False;
 177         }
 178
 179         /* Copy the sign/seal padding data. */
 180         if (ss_padding_len) {
 181                 char pad[8];
 182
 183                 memset(pad, '\0', 8);
 184                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 185                                       ss_padding_len)) {
 186                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 187                                         (unsigned int)ss_padding_len));
 188                         prs_mem_free(&p->out_data.frag);
 189                         return False;
 190                 }
 191         }
 192
 193
 194         /* Now write out the auth header and null blob. */
 195         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 196                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 197         } else {
 198                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 199         }
 200         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 201                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 202         } else {
 203                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 204         }
 205
 206         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 207         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &p->out_data.frag,
 208                                 0)) {
 209                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 210                 prs_mem_free(&p->out_data.frag);
 211                 return False;
 212         }
 213
 214         /* Generate the sign blob. */
 215
 216         switch (p->auth.auth_level) {
 217                 case DCERPC_AUTH_LEVEL_PRIVACY:
 218                         /* Data portion is encrypted. */
 219                         status = ntlmssp_seal_packet(
 220                                 a->ntlmssp_state,
 221                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 222                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 223                                 data_len + ss_padding_len,
 224                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 225                                 (size_t)prs_offset(&p->out_data.frag),
 226                                 &auth_blob);
 227                         if (!NT_STATUS_IS_OK(status)) {
 228                                 data_blob_free(&auth_blob);
 229                                 prs_mem_free(&p->out_data.frag);
 230                                 return False;
 231                         }
 232                         break;
 233                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 234                         /* Data is signed. */
 235                         status = ntlmssp_sign_packet(
 236                                 a->ntlmssp_state,
 237                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 238                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 239                                 data_len + ss_padding_len,
 240                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 241                                 (size_t)prs_offset(&p->out_data.frag),
 242                                 &auth_blob);
 243                         if (!NT_STATUS_IS_OK(status)) {
 244                                 data_blob_free(&auth_blob);
 245                                 prs_mem_free(&p->out_data.frag);
 246                                 return False;
 247                         }
 248                         break;
 249                 default:
 250                         prs_mem_free(&p->out_data.frag);
 251                         return False;
 252         }
 253
 254         /* Append the auth blob. */
 255         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 256                               NTLMSSP_SIG_SIZE)) {
 257                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 258                                 (unsigned int)NTLMSSP_SIG_SIZE));
 259                 data_blob_free(&auth_blob);
 260                 prs_mem_free(&p->out_data.frag);
 261                 return False;
 262         }
 263
 264         data_blob_free(&auth_blob);
 265
 266         /*
 267          * Setup the counts for this PDU.
 268          */
 269
 270         p->out_data.data_sent_length += data_len;
 271         p->out_data.current_pdu_sent = 0;
 272
 273         return True;
 274 }
 275
 276 /*******************************************************************
 277  Generate the next PDU to be returned from the data in p->rdata.
 278  Return an schannel authenticated fragment.
 279  ********************************************************************/
 280
 281 static bool create_next_pdu_schannel(pipes_struct *p)
 282 {
 283         RPC_HDR_RESP hdr_resp;
 284         uint32 ss_padding_len = 0;
 285         uint32 data_len;
 286         uint32 data_space_available;
 287         uint32 data_len_left;
 288         uint32 data_pos;
 289         NTSTATUS status;
 290
 291         /*
 292          * If we're in the fault state, keep returning fault PDU's until
 293          * the pipe gets closed. JRA.
 294          */
 295
 296         if(p->fault_state) {
 297                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 298                 return True;
 299         }
 300
 301         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 302
 303         /* Change the incoming request header to a response. */
 304         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 305
 306         /* Set up rpc header flags. */
 307         if (p->out_data.data_sent_length == 0) {
 308                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 309         } else {
 310                 p->hdr.flags = 0;
 311         }
 312
 313         /*
 314          * Work out how much we can fit in a single PDU.
 315          */
 316
 317         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 318
 319         /*
 320          * Ensure there really is data left to send.
 321          */
 322
 323         if(!data_len_left) {
 324                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 325                 return False;
 326         }
 327
 328         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 329                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 330                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 331
 332         /*
 333          * The amount we send is the minimum of the available
 334          * space and the amount left to send.
 335          */
 336
 337         data_len = MIN(data_len_left, data_space_available);
 338
 339         /*
 340          * Set up the alloc hint. This should be the data left to
 341          * send.
 342          */
 343
 344         hdr_resp.alloc_hint = data_len_left;
 345
 346         /*
 347          * Work out if this PDU will be the last.
 348          */
 349
 350         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 351                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 352                 if (data_len_left % 8) {
 353                         ss_padding_len = 8 - (data_len_left % 8);
 354                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 355                                 ss_padding_len ));
 356                 }
 357         }
 358
 359         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 360                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 361         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 362
 363         /*
 364          * Init the parse struct to point at the outgoing
 365          * data.
 366          */
 367
 368         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 369
 370         /* Store the header in the data stream. */
 371         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 372                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 373                 prs_mem_free(&p->out_data.frag);
 374                 return False;
 375         }
 376
 377         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 378                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 379                 prs_mem_free(&p->out_data.frag);
 380                 return False;
 381         }
 382
 383         /* Store the current offset. */
 384         data_pos = prs_offset(&p->out_data.frag);
 385
 386         /* Copy the data into the PDU. */
 387
 388         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 389                                      p->out_data.data_sent_length, data_len)) {
 390                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 391                 prs_mem_free(&p->out_data.frag);
 392                 return False;
 393         }
 394
 395         /* Copy the sign/seal padding data. */
 396         if (ss_padding_len) {
 397                 char pad[8];
 398                 memset(pad, '\0', 8);
 399                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 400                                       ss_padding_len)) {
 401                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 402                         prs_mem_free(&p->out_data.frag);
 403                         return False;
 404                 }
 405         }
 406
 407         {
 408                 /*
 409                  * Schannel processing.
 410                  */
 411                 RPC_HDR_AUTH auth_info;
 412                 DATA_BLOB blob;
 413                 uint8_t *data;
 414
 415                 /* Check it's the type of reply we were expecting to decode */
 416
 417                 init_rpc_hdr_auth(&auth_info,
 418                                 DCERPC_AUTH_TYPE_SCHANNEL,
 419                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 420                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 421                                 ss_padding_len, 1);
 422
 423                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 424                                         &p->out_data.frag, 0)) {
 425                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 426                         prs_mem_free(&p->out_data.frag);
 427                         return False;
 428                 }
 429
 430                 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
 431
 432                 switch (p->auth.auth_level) {
 433                 case DCERPC_AUTH_LEVEL_PRIVACY:
 434                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 435                                                         talloc_tos(),
 436                                                         true,
 437                                                         data,
 438                                                         data_len + ss_padding_len,
 439                                                         &blob);
 440                         break;
 441                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 442                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 443                                                         talloc_tos(),
 444                                                         false,
 445                                                         data,
 446                                                         data_len + ss_padding_len,
 447                                                         &blob);
 448                         break;
 449                 default:
 450                         status = NT_STATUS_INTERNAL_ERROR;
 451                         break;
 452                 }
 453
 454                 if (!NT_STATUS_IS_OK(status)) {
 455                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 456                                 nt_errstr(status)));
 457                         prs_mem_free(&p->out_data.frag);
 458                         return false;
 459                 }
 460
 461                 /* Finally marshall the blob. */
 462
 463                 if (DEBUGLEVEL >= 10) {
 464                         dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 465                 }
 466
 467                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 468                         prs_mem_free(&p->out_data.frag);
 469                         return false;
 470                 }
 471         }
 472
 473         /*
 474          * Setup the counts for this PDU.
 475          */
 476
 477         p->out_data.data_sent_length += data_len;
 478         p->out_data.current_pdu_sent = 0;
 479
 480         return True;
 481 }
 482
 483 /*******************************************************************
 484  Generate the next PDU to be returned from the data in p->rdata.
 485  No authentication done.
 486 ********************************************************************/
 487
 488 static bool create_next_pdu_noauth(pipes_struct *p)
 489 {
 490         RPC_HDR_RESP hdr_resp;
 491         uint32 data_len;
 492         uint32 data_space_available;
 493         uint32 data_len_left;
 494
 495         /*
 496          * If we're in the fault state, keep returning fault PDU's until
 497          * the pipe gets closed. JRA.
 498          */
 499
 500         if(p->fault_state) {
 501                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 502                 return True;
 503         }
 504
 505         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 506
 507         /* Change the incoming request header to a response. */
 508         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 509
 510         /* Set up rpc header flags. */
 511         if (p->out_data.data_sent_length == 0) {
 512                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 513         } else {
 514                 p->hdr.flags = 0;
 515         }
 516
 517         /*
 518          * Work out how much we can fit in a single PDU.
 519          */
 520
 521         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 522
 523         /*
 524          * Ensure there really is data left to send.
 525          */
 526
 527         if(!data_len_left) {
 528                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 529                 return False;
 530         }
 531
 532         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 533                 - RPC_HDR_RESP_LEN;
 534
 535         /*
 536          * The amount we send is the minimum of the available
 537          * space and the amount left to send.
 538          */
 539
 540         data_len = MIN(data_len_left, data_space_available);
 541
 542         /*
 543          * Set up the alloc hint. This should be the data left to
 544          * send.
 545          */
 546
 547         hdr_resp.alloc_hint = data_len_left;
 548
 549         /*
 550          * Work out if this PDU will be the last.
 551          */
 552
 553         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 554                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 555         }
 556
 557         /*
 558          * Set up the header lengths.
 559          */
 560
 561         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 562         p->hdr.auth_len = 0;
 563
 564         /*
 565          * Init the parse struct to point at the outgoing
 566          * data.
 567          */
 568
 569         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 570
 571         /* Store the header in the data stream. */
 572         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 573                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 574                 prs_mem_free(&p->out_data.frag);
 575                 return False;
 576         }
 577
 578         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 579                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 580                 prs_mem_free(&p->out_data.frag);
 581                 return False;
 582         }
 583
 584         /* Copy the data into the PDU. */
 585
 586         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 587                                      p->out_data.data_sent_length, data_len)) {
 588                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 589                 prs_mem_free(&p->out_data.frag);
 590                 return False;
 591         }
 592
 593         /*
 594          * Setup the counts for this PDU.
 595          */
 596
 597         p->out_data.data_sent_length += data_len;
 598         p->out_data.current_pdu_sent = 0;
 599
 600         return True;
 601 }
 602
 603 /*******************************************************************
 604  Generate the next PDU to be returned from the data in p->rdata.
 605 ********************************************************************/
 606
 607 bool create_next_pdu(pipes_struct *p)
 608 {
 609         switch(p->auth.auth_level) {
 610                 case DCERPC_AUTH_LEVEL_NONE:
 611                 case DCERPC_AUTH_LEVEL_CONNECT:
 612                         /* This is incorrect for auth level connect. Fixme. JRA */
 613                         return create_next_pdu_noauth(p);
 614
 615                 default:
 616                         switch(p->auth.auth_type) {
 617                                 case PIPE_AUTH_TYPE_NTLMSSP:
 618                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 619                                         return create_next_pdu_ntlmssp(p);
 620                                 case PIPE_AUTH_TYPE_SCHANNEL:
 621                                         return create_next_pdu_schannel(p);
 622                                 default:
 623                                         break;
 624                         }
 625         }
 626
 627         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 628                         (unsigned int)p->auth.auth_level,
 629                         (unsigned int)p->auth.auth_type));
 630         return False;
 631 }
 632
 633 /*******************************************************************
 634  Process an NTLMSSP authentication response.
 635  If this function succeeds, the user has been authenticated
 636  and their domain, name and calling workstation stored in
 637  the pipe struct.
 638 *******************************************************************/
 639
 640 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 641 {
 642         DATA_BLOB session_key, reply;
 643         NTSTATUS status;
 644         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 645         bool ret;
 646
 647         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 648                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 649
 650         ZERO_STRUCT(reply);
 651
 652         /* this has to be done as root in order to verify the password */
 653         become_root();
 654         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 655         unbecome_root();
 656
 657         /* Don't generate a reply. */
 658         data_blob_free(&reply);
 659
 660         if (!NT_STATUS_IS_OK(status)) {
 661                 return False;
 662         }
 663
 664         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 665            ensure the underlying NTLMSSP flags are also set. If not we should
 666            refuse the bind. */
 667
 668         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 669                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 670                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 671                                 "but client declined signing.\n",
 672                                  get_pipe_name_from_syntax(talloc_tos(),
 673                                                            &p->syntax)));
 674                         return False;
 675                 }
 676         }
 677         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 678                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 679                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 680                                 "but client declined sealing.\n",
 681                                  get_pipe_name_from_syntax(talloc_tos(),
 682                                                            &p->syntax)));
 683                         return False;
 684                 }
 685         }
 686
 687         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 688                   "workstation: %s\n", a->ntlmssp_state->user,
 689                   a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
 690
 691         if (a->server_info->ptok == NULL) {
 692                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 693                 return False;
 694         }
 695
 696         TALLOC_FREE(p->server_info);
 697
 698         p->server_info = copy_serverinfo(p, a->server_info);
 699         if (p->server_info == NULL) {
 700                 DEBUG(0, ("copy_serverinfo failed\n"));
 701                 return false;
 702         }
 703
 704         /*
 705          * We're an authenticated bind over smb, so the session key needs to
 706          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 707          * does. See the RPC-SAMBA3SESSIONKEY.
 708          */
 709
 710         session_key = generic_session_key();
 711         if (session_key.data == NULL) {
 712                 return False;
 713         }
 714
 715         ret = server_info_set_session_key(p->server_info, session_key);
 716
 717         data_blob_free(&session_key);
 718
 719         return True;
 720 }
 721
 722 /*******************************************************************
 723  The switch table for the pipe names and the functions to handle them.
 724 *******************************************************************/
 725
 726 struct rpc_table {
 727         struct {
 728                 const char *clnt;
 729                 const char *srv;
 730         } pipe;
 731         struct ndr_syntax_id rpc_interface;
 732         const struct api_struct *cmds;
 733         int n_cmds;
 734 };
 735
 736 static struct rpc_table *rpc_lookup;
 737 static int rpc_lookup_size;
 738
 739 /*******************************************************************
 740  This is the "stage3" NTLMSSP response after a bind request and reply.
 741 *******************************************************************/
 742
 743 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 744 {
 745         RPC_HDR_AUTH auth_info;
 746         uint32 pad = 0;
 747         DATA_BLOB blob;
 748
 749         ZERO_STRUCT(blob);
 750
 751         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 752
 753         if (p->hdr.auth_len == 0) {
 754                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 755                 goto err;
 756         }
 757
 758         /* 4 bytes padding. */
 759         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 760                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 761                 goto err;
 762         }
 763
 764         /*
 765          * Decode the authentication verifier response.
 766          */
 767
 768         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 769                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 770                 goto err;
 771         }
 772
 773         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 774                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 775                         (unsigned int)auth_info.auth_type ));
 776                 return False;
 777         }
 778
 779         blob = data_blob(NULL,p->hdr.auth_len);
 780
 781         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 782                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 783                         (unsigned int)p->hdr.auth_len ));
 784                 goto err;
 785         }
 786
 787         /*
 788          * The following call actually checks the challenge/response data.
 789          * for correctness against the given DOMAIN\user name.
 790          */
 791
 792         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 793                 goto err;
 794         }
 795
 796         data_blob_free(&blob);
 797
 798         p->pipe_bound = True;
 799
 800         return True;
 801
 802  err:
 803
 804         data_blob_free(&blob);
 805         free_pipe_ntlmssp_auth_data(&p->auth);
 806         p->auth.a_u.auth_ntlmssp_state = NULL;
 807
 808         return False;
 809 }
 810
 811 /*******************************************************************
 812  Marshall a bind_nak pdu.
 813 *******************************************************************/
 814
 815 static bool setup_bind_nak(pipes_struct *p)
 816 {
 817         RPC_HDR nak_hdr;
 818         uint16 zero = 0;
 819
 820         /* Free any memory in the current return data buffer. */
 821         prs_mem_free(&p->out_data.rdata);
 822
 823         /*
 824          * Marshall directly into the outgoing PDU space. We
 825          * must do this as we need to set to the bind response
 826          * header and are never sending more than one PDU here.
 827          */
 828
 829         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 830
 831         /*
 832          * Initialize a bind_nak header.
 833          */
 834
 835         init_rpc_hdr(&nak_hdr, DCERPC_PKT_BIND_NAK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
 836                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 837
 838         /*
 839          * Marshall the header into the outgoing PDU.
 840          */
 841
 842         if(!smb_io_rpc_hdr("", &nak_hdr, &p->out_data.frag, 0)) {
 843                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 844                 prs_mem_free(&p->out_data.frag);
 845                 return False;
 846         }
 847
 848         /*
 849          * Now add the reject reason.
 850          */
 851
 852         if(!prs_uint16("reject code", &p->out_data.frag, 0, &zero)) {
 853                 prs_mem_free(&p->out_data.frag);
 854                 return False;
 855         }
 856
 857         p->out_data.data_sent_length = 0;
 858         p->out_data.current_pdu_sent = 0;
 859
 860         if (p->auth.auth_data_free_func) {
 861                 (*p->auth.auth_data_free_func)(&p->auth);
 862         }
 863         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 864         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 865         p->pipe_bound = False;
 866
 867         return True;
 868 }
 869
 870 /*******************************************************************
 871  Marshall a fault pdu.
 872 *******************************************************************/
 873
 874 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 875 {
 876         RPC_HDR fault_hdr;
 877         RPC_HDR_RESP hdr_resp;
 878         RPC_HDR_FAULT fault_resp;
 879
 880         /* Free any memory in the current return data buffer. */
 881         prs_mem_free(&p->out_data.rdata);
 882
 883         /*
 884          * Marshall directly into the outgoing PDU space. We
 885          * must do this as we need to set to the bind response
 886          * header and are never sending more than one PDU here.
 887          */
 888
 889         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 890
 891         /*
 892          * Initialize a fault header.
 893          */
 894
 895         init_rpc_hdr(&fault_hdr, DCERPC_PKT_FAULT, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 896             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 897
 898         /*
 899          * Initialize the HDR_RESP and FAULT parts of the PDU.
 900          */
 901
 902         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 903
 904         fault_resp.status = status;
 905         fault_resp.reserved = 0;
 906
 907         /*
 908          * Marshall the header into the outgoing PDU.
 909          */
 910
 911         if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
 912                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 913                 prs_mem_free(&p->out_data.frag);
 914                 return False;
 915         }
 916
 917         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 918                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 919                 prs_mem_free(&p->out_data.frag);
 920                 return False;
 921         }
 922
 923         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
 924                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 925                 prs_mem_free(&p->out_data.frag);
 926                 return False;
 927         }
 928
 929         p->out_data.data_sent_length = 0;
 930         p->out_data.current_pdu_sent = 0;
 931
 932         return True;
 933 }
 934
 935 #if 0
 936 /*******************************************************************
 937  Marshall a cancel_ack pdu.
 938  We should probably check the auth-verifier here.
 939 *******************************************************************/
 940
 941 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 942 {
 943         prs_struct outgoing_pdu;
 944         RPC_HDR ack_reply_hdr;
 945
 946         /* Free any memory in the current return data buffer. */
 947         prs_mem_free(&p->out_data.rdata);
 948
 949         /*
 950          * Marshall directly into the outgoing PDU space. We
 951          * must do this as we need to set to the bind response
 952          * header and are never sending more than one PDU here.
 953          */
 954
 955         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 956         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 957
 958         /*
 959          * Initialize a cancel_ack header.
 960          */
 961
 962         init_rpc_hdr(&ack_reply_hdr, DCERPC_PKT_CANCEL_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
 963                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 964
 965         /*
 966          * Marshall the header into the outgoing PDU.
 967          */
 968
 969         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 970                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 971                 prs_mem_free(&outgoing_pdu);
 972                 return False;
 973         }
 974
 975         p->out_data.data_sent_length = 0;
 976         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 977         p->out_data.current_pdu_sent = 0;
 978
 979         prs_mem_free(&outgoing_pdu);
 980         return True;
 981 }
 982 #endif
 983
 984 /*******************************************************************
 985  Ensure a bind request has the correct abstract & transfer interface.
 986  Used to reject unknown binds from Win2k.
 987 *******************************************************************/
 988
 989 static bool check_bind_req(struct pipes_struct *p,
 990                            struct ndr_syntax_id* abstract,
 991                            struct ndr_syntax_id* transfer,
 992                            uint32 context_id)
 993 {
 994         int i=0;
 995         struct pipe_rpc_fns *context_fns;
 996
 997         DEBUG(3,("check_bind_req for %s\n",
 998                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 999
1000         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
1001
1002         for (i=0; i<rpc_lookup_size; i++) {
1003                 DEBUGADD(10, ("checking %s\n", rpc_lookup[i].pipe.clnt));
1004                 if (ndr_syntax_id_equal(
1005                             abstract, &rpc_lookup[i].rpc_interface)
1006                     && ndr_syntax_id_equal(
1007                             transfer, &ndr_transfer_syntax)) {
1008                         break;
1009                 }
1010         }
1011
1012         if (i == rpc_lookup_size) {
1013                 return false;
1014         }
1015
1016         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
1017         if (context_fns == NULL) {
1018                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1019                 return False;
1020         }
1021
1022         context_fns->cmds = rpc_lookup[i].cmds;
1023         context_fns->n_cmds = rpc_lookup[i].n_cmds;
1024         context_fns->context_id = context_id;
1025
1026         /* add to the list of open contexts */
1027
1028         DLIST_ADD( p->contexts, context_fns );
1029
1030         return True;
1031 }
1032
1033 /*******************************************************************
1034  Register commands to an RPC pipe
1035 *******************************************************************/
1036
1037 NTSTATUS rpc_srv_register(int version, const char *clnt, const char *srv,
1038                           const struct ndr_interface_table *iface,
1039                           const struct api_struct *cmds, int size)
1040 {
1041         struct rpc_table *rpc_entry;
1042
1043         if (!clnt || !srv || !cmds) {
1044                 return NT_STATUS_INVALID_PARAMETER;
1045         }
1046
1047         if (version != SMB_RPC_INTERFACE_VERSION) {
1048                 DEBUG(0,("Can't register rpc commands!\n"
1049                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1050                          ", while this version of samba uses version %d!\n",
1051                          version,SMB_RPC_INTERFACE_VERSION));
1052                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1053         }
1054
1055         /* TODO:
1056          *
1057          * we still need to make sure that don't register the same commands twice!!!
1058          *
1059          * --metze
1060          */
1061
1062         /* We use a temporary variable because this call can fail and
1063            rpc_lookup will still be valid afterwards.  It could then succeed if
1064            called again later */
1065         rpc_lookup_size++;
1066         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1067         if (NULL == rpc_entry) {
1068                 rpc_lookup_size--;
1069                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1070                 return NT_STATUS_NO_MEMORY;
1071         } else {
1072                 rpc_lookup = rpc_entry;
1073         }
1074
1075         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1076         ZERO_STRUCTP(rpc_entry);
1077         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1078         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1079         rpc_entry->rpc_interface = iface->syntax_id;
1080         rpc_entry->cmds = cmds;
1081         rpc_entry->n_cmds = size;
1082
1083         return NT_STATUS_OK;
1084 }
1085
1086 /**
1087  * Is a named pipe known?
1088  * @param[in] cli_filename      The pipe name requested by the client
1089  * @result                      Do we want to serve this?
1090  */
1091 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1092 {
1093         const char *pipename = cli_filename;
1094         int i;
1095         NTSTATUS status;
1096
1097         if (strnequal(pipename, "\\PIPE\\", 6)) {
1098                 pipename += 5;
1099         }
1100
1101         if (*pipename == '\\') {
1102                 pipename += 1;
1103         }
1104
1105         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1106                 DEBUG(10, ("refusing spoolss access\n"));
1107                 return false;
1108         }
1109
1110         for (i=0; i<rpc_lookup_size; i++) {
1111                 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1112                         *syntax = rpc_lookup[i].rpc_interface;
1113                         return true;
1114                 }
1115         }
1116
1117         status = smb_probe_module("rpc", pipename);
1118         if (!NT_STATUS_IS_OK(status)) {
1119                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1120                 return false;
1121         }
1122         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1123
1124         /*
1125          * Scan the list again for the interface id
1126          */
1127
1128         for (i=0; i<rpc_lookup_size; i++) {
1129                 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1130                         *syntax = rpc_lookup[i].rpc_interface;
1131                         return true;
1132                 }
1133         }
1134
1135         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1136                    pipename));
1137
1138         return false;
1139 }
1140
1141 /*******************************************************************
1142  Handle a SPNEGO krb5 bind auth.
1143 *******************************************************************/
1144
1145 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1146                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1147 {
1148         return False;
1149 }
1150
1151 /*******************************************************************
1152  Handle the first part of a SPNEGO bind auth.
1153 *******************************************************************/
1154
1155 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1156                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1157 {
1158         DATA_BLOB blob;
1159         DATA_BLOB secblob;
1160         DATA_BLOB response;
1161         DATA_BLOB chal;
1162         char *OIDs[ASN1_MAX_OIDS];
1163         int i;
1164         NTSTATUS status;
1165         bool got_kerberos_mechanism = false;
1166         AUTH_NTLMSSP_STATE *a = NULL;
1167         RPC_HDR_AUTH auth_info;
1168
1169         ZERO_STRUCT(secblob);
1170         ZERO_STRUCT(chal);
1171         ZERO_STRUCT(response);
1172
1173         /* Grab the SPNEGO blob. */
1174         blob = data_blob(NULL,p->hdr.auth_len);
1175
1176         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1177                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1178                         (unsigned int)p->hdr.auth_len ));
1179                 goto err;
1180         }
1181
1182         if (blob.data[0] != ASN1_APPLICATION(0)) {
1183                 goto err;
1184         }
1185
1186         /* parse out the OIDs and the first sec blob */
1187         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1188                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1189                 goto err;
1190         }
1191
1192         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1193                 got_kerberos_mechanism = true;
1194         }
1195
1196         for (i=0;OIDs[i];i++) {
1197                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1198                 TALLOC_FREE(OIDs[i]);
1199         }
1200         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1201
1202         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1203                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1204                 data_blob_free(&secblob);
1205                 data_blob_free(&blob);
1206                 return ret;
1207         }
1208
1209         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1210                 /* Free any previous auth type. */
1211                 free_pipe_ntlmssp_auth_data(&p->auth);
1212         }
1213
1214         if (!got_kerberos_mechanism) {
1215                 /* Initialize the NTLM engine. */
1216                 status = auth_ntlmssp_start(&a);
1217                 if (!NT_STATUS_IS_OK(status)) {
1218                         goto err;
1219                 }
1220
1221                 /*
1222                  * Pass the first security blob of data to it.
1223                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1224                  * which means we need another packet to complete the bind.
1225                  */
1226
1227                 status = auth_ntlmssp_update(a, secblob, &chal);
1228
1229                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1230                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1231                         goto err;
1232                 }
1233
1234                 /* Generate the response blob we need for step 2 of the bind. */
1235                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1236         } else {
1237                 /*
1238                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1239                  * code to process follow-up packets is not complete
1240                  * yet. JRA.
1241                  */
1242                 response = spnego_gen_auth_response(NULL,
1243                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1244                                         OID_NTLMSSP);
1245         }
1246
1247         /* Copy the blob into the pout_auth parse struct */
1248         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1249         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1250                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1251                 goto err;
1252         }
1253
1254         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1255                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1256                 goto err;
1257         }
1258
1259         p->auth.a_u.auth_ntlmssp_state = a;
1260         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1261         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1262
1263         data_blob_free(&blob);
1264         data_blob_free(&secblob);
1265         data_blob_free(&chal);
1266         data_blob_free(&response);
1267
1268         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1269         return True;
1270
1271  err:
1272
1273         data_blob_free(&blob);
1274         data_blob_free(&secblob);
1275         data_blob_free(&chal);
1276         data_blob_free(&response);
1277
1278         p->auth.a_u.auth_ntlmssp_state = NULL;
1279
1280         return False;
1281 }
1282
1283 /*******************************************************************
1284  Handle the second part of a SPNEGO bind auth.
1285 *******************************************************************/
1286
1287 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1288                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1289 {
1290         RPC_HDR_AUTH auth_info;
1291         DATA_BLOB spnego_blob;
1292         DATA_BLOB auth_blob;
1293         DATA_BLOB auth_reply;
1294         DATA_BLOB response;
1295         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1296
1297         ZERO_STRUCT(spnego_blob);
1298         ZERO_STRUCT(auth_blob);
1299         ZERO_STRUCT(auth_reply);
1300         ZERO_STRUCT(response);
1301
1302         /*
1303          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1304          * fail here as 'a' == NULL.
1305          */
1306         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1307                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1308                 goto err;
1309         }
1310
1311         /* Grab the SPNEGO blob. */
1312         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1313
1314         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1315                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1316                         (unsigned int)p->hdr.auth_len ));
1317                 goto err;
1318         }
1319
1320         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1321                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1322                 goto err;
1323         }
1324
1325         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1326                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1327                 goto err;
1328         }
1329
1330         /*
1331          * The following call actually checks the challenge/response data.
1332          * for correctness against the given DOMAIN\user name.
1333          */
1334
1335         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1336                 goto err;
1337         }
1338
1339         data_blob_free(&spnego_blob);
1340         data_blob_free(&auth_blob);
1341
1342         /* Generate the spnego "accept completed" blob - no incoming data. */
1343         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1344
1345         /* Copy the blob into the pout_auth parse struct */
1346         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1347         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1348                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1349                 goto err;
1350         }
1351
1352         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1353                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1354                 goto err;
1355         }
1356
1357         data_blob_free(&auth_reply);
1358         data_blob_free(&response);
1359
1360         p->pipe_bound = True;
1361
1362         return True;
1363
1364  err:
1365
1366         data_blob_free(&spnego_blob);
1367         data_blob_free(&auth_blob);
1368         data_blob_free(&auth_reply);
1369         data_blob_free(&response);
1370
1371         free_pipe_ntlmssp_auth_data(&p->auth);
1372         p->auth.a_u.auth_ntlmssp_state = NULL;
1373
1374         return False;
1375 }
1376
1377 /*******************************************************************
1378  Handle an schannel bind auth.
1379 *******************************************************************/
1380
1381 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1382                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1383 {
1384         RPC_HDR_AUTH auth_info;
1385         struct NL_AUTH_MESSAGE neg;
1386         struct NL_AUTH_MESSAGE reply;
1387         bool ret;
1388         NTSTATUS status;
1389         struct netlogon_creds_CredentialState *creds;
1390         DATA_BLOB session_key;
1391         enum ndr_err_code ndr_err;
1392         DATA_BLOB blob;
1393
1394         blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1395                                prs_data_size(rpc_in_p));
1396
1397         ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &neg,
1398                                (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1399         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1400                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1401                 return false;
1402         }
1403
1404         if (DEBUGLEVEL >= 10) {
1405                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1406         }
1407
1408         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1409                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1410                 return false;
1411         }
1412
1413         /*
1414          * The neg.oem_netbios_computer.a key here must match the remote computer name
1415          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1416          * operations that use credentials.
1417          */
1418
1419         become_root();
1420         status = schannel_fetch_session_key(p,
1421                                             neg.oem_netbios_computer.a,
1422                                             &creds);
1423         unbecome_root();
1424
1425         if (!NT_STATUS_IS_OK(status)) {
1426                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1427                 return False;
1428         }
1429
1430         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1431         if (!p->auth.a_u.schannel_auth) {
1432                 TALLOC_FREE(creds);
1433                 return False;
1434         }
1435
1436         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1437         p->auth.a_u.schannel_auth->seq_num = 0;
1438         p->auth.a_u.schannel_auth->initiator = false;
1439         p->auth.a_u.schannel_auth->creds = creds;
1440
1441         /*
1442          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1443          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1444          * struct of the person who opened the pipe. I need to test this further. JRA.
1445          *
1446          * VL. As we are mapping this to guest set the generic key
1447          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1448          * W2k3, as it does not allow schannel binds against SAMR and LSA
1449          * anymore.
1450          */
1451
1452         session_key = generic_session_key();
1453         if (session_key.data == NULL) {
1454                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1455                           " key\n"));
1456                 return false;
1457         }
1458
1459         ret = server_info_set_session_key(p->server_info, session_key);
1460
1461         data_blob_free(&session_key);
1462
1463         if (!ret) {
1464                 DEBUG(0, ("server_info_set_session_key failed\n"));
1465                 return false;
1466         }
1467
1468         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1469         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1470                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1471                 return False;
1472         }
1473
1474         /*** SCHANNEL verifier ***/
1475
1476         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1477         reply.Flags                             = 0;
1478         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1479                                                       * this has any meaning
1480                                                       * here - gd */
1481
1482         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &reply,
1483                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1484         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1485                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1486                 return false;
1487         }
1488
1489         if (DEBUGLEVEL >= 10) {
1490                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1491         }
1492
1493         if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1494                 return false;
1495         }
1496
1497         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1498                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1499
1500         /* We're finished with this bind - no more packets. */
1501         p->auth.auth_data_free_func = NULL;
1502         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1503
1504         p->pipe_bound = True;
1505
1506         return True;
1507 }
1508
1509 /*******************************************************************
1510  Handle an NTLMSSP bind auth.
1511 *******************************************************************/
1512
1513 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1514                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1515 {
1516         RPC_HDR_AUTH auth_info;
1517         DATA_BLOB blob;
1518         DATA_BLOB response;
1519         NTSTATUS status;
1520         AUTH_NTLMSSP_STATE *a = NULL;
1521
1522         ZERO_STRUCT(blob);
1523         ZERO_STRUCT(response);
1524
1525         /* Grab the NTLMSSP blob. */
1526         blob = data_blob(NULL,p->hdr.auth_len);
1527
1528         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1529                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1530                         (unsigned int)p->hdr.auth_len ));
1531                 goto err;
1532         }
1533
1534         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1535                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1536                 goto err;
1537         }
1538
1539         /* We have an NTLMSSP blob. */
1540         status = auth_ntlmssp_start(&a);
1541         if (!NT_STATUS_IS_OK(status)) {
1542                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1543                         nt_errstr(status) ));
1544                 goto err;
1545         }
1546
1547         status = auth_ntlmssp_update(a, blob, &response);
1548         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1549                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1550                         nt_errstr(status) ));
1551                 goto err;
1552         }
1553
1554         data_blob_free(&blob);
1555
1556         /* Copy the blob into the pout_auth parse struct */
1557         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1558         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1559                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1560                 goto err;
1561         }
1562
1563         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1564                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1565                 goto err;
1566         }
1567
1568         p->auth.a_u.auth_ntlmssp_state = a;
1569         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1570         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1571
1572         data_blob_free(&blob);
1573         data_blob_free(&response);
1574
1575         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1576
1577         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1578         return True;
1579
1580   err:
1581
1582         data_blob_free(&blob);
1583         data_blob_free(&response);
1584
1585         free_pipe_ntlmssp_auth_data(&p->auth);
1586         p->auth.a_u.auth_ntlmssp_state = NULL;
1587         return False;
1588 }
1589
1590 /*******************************************************************
1591  Respond to a pipe bind request.
1592 *******************************************************************/
1593
1594 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1595 {
1596         RPC_HDR_BA hdr_ba;
1597         RPC_HDR_RB hdr_rb;
1598         RPC_HDR_AUTH auth_info;
1599         uint16 assoc_gid;
1600         fstring ack_pipe_name;
1601         prs_struct out_hdr_ba;
1602         prs_struct out_auth;
1603         int i = 0;
1604         int auth_len = 0;
1605         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1606
1607         /* No rebinds on a bound pipe - use alter context. */
1608         if (p->pipe_bound) {
1609                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1610                          "pipe %s.\n",
1611                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1612                 return setup_bind_nak(p);
1613         }
1614
1615         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1616
1617         /*
1618          * Marshall directly into the outgoing PDU space. We
1619          * must do this as we need to set to the bind response
1620          * header and are never sending more than one PDU here.
1621          */
1622
1623         /*
1624          * Setup the memory to marshall the ba header, and the
1625          * auth footers.
1626          */
1627
1628         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1629                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1630                 prs_mem_free(&p->out_data.frag);
1631                 return False;
1632         }
1633
1634         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1635                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1636                 prs_mem_free(&p->out_data.frag);
1637                 prs_mem_free(&out_hdr_ba);
1638                 return False;
1639         }
1640
1641         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1642
1643         ZERO_STRUCT(hdr_rb);
1644
1645         /* decode the bind request */
1646
1647         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1648                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1649                          "struct.\n"));
1650                 goto err_exit;
1651         }
1652
1653         if (hdr_rb.num_contexts == 0) {
1654                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1655                 goto err_exit;
1656         }
1657
1658         /*
1659          * Try and find the correct pipe name to ensure
1660          * that this is a pipe name we support.
1661          */
1662
1663         for (i = 0; i < rpc_lookup_size; i++) {
1664                 if (ndr_syntax_id_equal(&rpc_lookup[i].rpc_interface,
1665                                         &hdr_rb.rpc_context[0].abstract)) {
1666                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1667                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1668                         break;
1669                 }
1670         }
1671
1672         if (i == rpc_lookup_size) {
1673                 NTSTATUS status;
1674
1675                 status = smb_probe_module(
1676                         "rpc", get_pipe_name_from_syntax(
1677                                 talloc_tos(),
1678                                 &hdr_rb.rpc_context[0].abstract));
1679
1680                 if (NT_STATUS_IS_ERR(status)) {
1681                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1682                                 get_pipe_name_from_syntax(
1683                                         talloc_tos(),
1684                                         &hdr_rb.rpc_context[0].abstract)));
1685                         prs_mem_free(&p->out_data.frag);
1686                         prs_mem_free(&out_hdr_ba);
1687                         prs_mem_free(&out_auth);
1688
1689                         return setup_bind_nak(p);
1690                 }
1691
1692                 for (i = 0; i < rpc_lookup_size; i++) {
1693                        if (strequal(rpc_lookup[i].pipe.clnt,
1694                                     get_pipe_name_from_syntax(talloc_tos(),
1695                                                               &p->syntax))) {
1696                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1697                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1698                                break;
1699                        }
1700                 }
1701
1702                 if (i == rpc_lookup_size) {
1703                         DEBUG(0, ("module %s doesn't provide functions for "
1704                                   "pipe %s!\n",
1705                                   get_pipe_name_from_syntax(talloc_tos(),
1706                                                             &p->syntax),
1707                                   get_pipe_name_from_syntax(talloc_tos(),
1708                                                             &p->syntax)));
1709                         goto err_exit;
1710                 }
1711         }
1712
1713         /* name has to be \PIPE\xxxxx */
1714         fstrcpy(ack_pipe_name, "\\PIPE\\");
1715         fstrcat(ack_pipe_name, rpc_lookup[i].pipe.srv);
1716
1717         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1718
1719         /*
1720          * Check if this is an authenticated bind request.
1721          */
1722
1723         if (p->hdr.auth_len) {
1724                 /*
1725                  * Decode the authentication verifier.
1726                  */
1727
1728                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1729                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1730                         goto err_exit;
1731                 }
1732
1733                 auth_type = auth_info.auth_type;
1734
1735                 /* Work out if we have to sign or seal etc. */
1736                 switch (auth_info.auth_level) {
1737                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1738                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1739                                 break;
1740                         case DCERPC_AUTH_LEVEL_PRIVACY:
1741                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1742                                 break;
1743                         default:
1744                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1745                                         (unsigned int)auth_info.auth_level ));
1746                                 goto err_exit;
1747                 }
1748         } else {
1749                 ZERO_STRUCT(auth_info);
1750         }
1751
1752         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1753
1754         switch(auth_type) {
1755                 case DCERPC_AUTH_TYPE_NTLMSSP:
1756                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1757                                 goto err_exit;
1758                         }
1759                         assoc_gid = 0x7a77;
1760                         break;
1761
1762                 case DCERPC_AUTH_TYPE_SCHANNEL:
1763                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1764                                 goto err_exit;
1765                         }
1766                         break;
1767
1768                 case DCERPC_AUTH_TYPE_SPNEGO:
1769                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1770                                 goto err_exit;
1771                         }
1772                         break;
1773
1774                 case DCERPC_AUTH_TYPE_NONE:
1775                         /* Unauthenticated bind request. */
1776                         /* We're finished - no more packets. */
1777                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1778                         /* We must set the pipe auth_level here also. */
1779                         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1780                         p->pipe_bound = True;
1781                         /* The session key was initialized from the SMB
1782                          * session in make_internal_rpc_pipe_p */
1783                         break;
1784
1785                 default:
1786                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1787                         goto err_exit;
1788         }
1789
1790         /*
1791          * Create the bind response struct.
1792          */
1793
1794         /* If the requested abstract synt uuid doesn't match our client pipe,
1795                 reject the bind_ack & set the transfer interface synt to all 0's,
1796                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1797                 unknown to NT4)
1798                 Needed when adding entries to a DACL from NT5 - SK */
1799
1800         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1801                                 hdr_rb.rpc_context[0].context_id )) {
1802                 init_rpc_hdr_ba(&hdr_ba,
1803                         RPC_MAX_PDU_FRAG_LEN,
1804                         RPC_MAX_PDU_FRAG_LEN,
1805                         assoc_gid,
1806                         ack_pipe_name,
1807                         0x1, 0x0, 0x0,
1808                         &hdr_rb.rpc_context[0].transfer[0]);
1809         } else {
1810                 /* Rejection reason: abstract syntax not supported */
1811                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1812                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1813                                         ack_pipe_name, 0x1, 0x2, 0x1,
1814                                         &null_ndr_syntax_id);
1815                 p->pipe_bound = False;
1816         }
1817
1818         /*
1819          * and marshall it.
1820          */
1821
1822         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1823                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1824                 goto err_exit;
1825         }
1826
1827         /*
1828          * Create the header, now we know the length.
1829          */
1830
1831         if (prs_offset(&out_auth)) {
1832                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1833         }
1834
1835         init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1836                         p->hdr.call_id,
1837                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1838                         auth_len);
1839
1840         /*
1841          * Marshall the header into the outgoing PDU.
1842          */
1843
1844         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1845                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1846                 goto err_exit;
1847         }
1848
1849         /*
1850          * Now add the RPC_HDR_BA and any auth needed.
1851          */
1852
1853         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1854                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1855                 goto err_exit;
1856         }
1857
1858         if (auth_len && !prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1859                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1860                 goto err_exit;
1861         }
1862
1863         /*
1864          * Setup the lengths for the initial reply.
1865          */
1866
1867         p->out_data.data_sent_length = 0;
1868         p->out_data.current_pdu_sent = 0;
1869
1870         prs_mem_free(&out_hdr_ba);
1871         prs_mem_free(&out_auth);
1872
1873         return True;
1874
1875   err_exit:
1876
1877         prs_mem_free(&p->out_data.frag);
1878         prs_mem_free(&out_hdr_ba);
1879         prs_mem_free(&out_auth);
1880         return setup_bind_nak(p);
1881 }
1882
1883 /****************************************************************************
1884  Deal with an alter context call. Can be third part of 3 leg auth request for
1885  SPNEGO calls.
1886 ****************************************************************************/
1887
1888 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1889 {
1890         RPC_HDR_BA hdr_ba;
1891         RPC_HDR_RB hdr_rb;
1892         RPC_HDR_AUTH auth_info;
1893         uint16 assoc_gid;
1894         fstring ack_pipe_name;
1895         prs_struct out_hdr_ba;
1896         prs_struct out_auth;
1897         int auth_len = 0;
1898
1899         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1900
1901         /*
1902          * Marshall directly into the outgoing PDU space. We
1903          * must do this as we need to set to the bind response
1904          * header and are never sending more than one PDU here.
1905          */
1906
1907         /*
1908          * Setup the memory to marshall the ba header, and the
1909          * auth footers.
1910          */
1911
1912         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1913                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1914                 prs_mem_free(&p->out_data.frag);
1915                 return False;
1916         }
1917
1918         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1919                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1920                 prs_mem_free(&p->out_data.frag);
1921                 prs_mem_free(&out_hdr_ba);
1922                 return False;
1923         }
1924
1925         ZERO_STRUCT(hdr_rb);
1926
1927         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1928
1929         /* decode the alter context request */
1930         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1931                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1932                 goto err_exit;
1933         }
1934
1935         /* secondary address CAN be NULL
1936          * as the specs say it's ignored.
1937          * It MUST be NULL to have the spoolss working.
1938          */
1939         fstrcpy(ack_pipe_name,"");
1940
1941         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1942
1943         /*
1944          * Check if this is an authenticated alter context request.
1945          */
1946
1947         if (p->hdr.auth_len != 0) {
1948                 /*
1949                  * Decode the authentication verifier.
1950                  */
1951
1952                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1953                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1954                         goto err_exit;
1955                 }
1956
1957                 /*
1958                  * Currently only the SPNEGO auth type uses the alter ctx
1959                  * response in place of the NTLMSSP auth3 type.
1960                  */
1961
1962                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
1963                         /* We can only finish if the pipe is unbound. */
1964                         if (!p->pipe_bound) {
1965                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1966                                         goto err_exit;
1967                                 }
1968                         } else {
1969                                 goto err_exit;
1970                         }
1971                 }
1972         } else {
1973                 ZERO_STRUCT(auth_info);
1974         }
1975
1976         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1977
1978         /*
1979          * Create the bind response struct.
1980          */
1981
1982         /* If the requested abstract synt uuid doesn't match our client pipe,
1983                 reject the bind_ack & set the transfer interface synt to all 0's,
1984                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1985                 unknown to NT4)
1986                 Needed when adding entries to a DACL from NT5 - SK */
1987
1988         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1989                                 hdr_rb.rpc_context[0].context_id )) {
1990                 init_rpc_hdr_ba(&hdr_ba,
1991                         RPC_MAX_PDU_FRAG_LEN,
1992                         RPC_MAX_PDU_FRAG_LEN,
1993                         assoc_gid,
1994                         ack_pipe_name,
1995                         0x1, 0x0, 0x0,
1996                         &hdr_rb.rpc_context[0].transfer[0]);
1997         } else {
1998                 /* Rejection reason: abstract syntax not supported */
1999                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
2000                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
2001                                         ack_pipe_name, 0x1, 0x2, 0x1,
2002                                         &null_ndr_syntax_id);
2003                 p->pipe_bound = False;
2004         }
2005
2006         /*
2007          * and marshall it.
2008          */
2009
2010         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
2011                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
2012                 goto err_exit;
2013         }
2014
2015         /*
2016          * Create the header, now we know the length.
2017          */
2018
2019         if (prs_offset(&out_auth)) {
2020                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
2021         }
2022
2023         init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
2024                         p->hdr.call_id,
2025                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2026                         auth_len);
2027
2028         /*
2029          * Marshall the header into the outgoing PDU.
2030          */
2031
2032         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2033                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2034                 goto err_exit;
2035         }
2036
2037         /*
2038          * Now add the RPC_HDR_BA and any auth needed.
2039          */
2040
2041         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2042                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2043                 goto err_exit;
2044         }
2045
2046         if (auth_len && !prs_append_prs_data(&p->out_data.frag, &out_auth)) {
2047                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2048                 goto err_exit;
2049         }
2050
2051         /*
2052          * Setup the lengths for the initial reply.
2053          */
2054
2055         p->out_data.data_sent_length = 0;
2056         p->out_data.current_pdu_sent = 0;
2057
2058         prs_mem_free(&out_hdr_ba);
2059         prs_mem_free(&out_auth);
2060
2061         return True;
2062
2063   err_exit:
2064
2065         prs_mem_free(&p->out_data.frag);
2066         prs_mem_free(&out_hdr_ba);
2067         prs_mem_free(&out_auth);
2068         return setup_bind_nak(p);
2069 }
2070
2071 /****************************************************************************
2072  Deal with NTLMSSP sign & seal processing on an RPC request.
2073 ****************************************************************************/
2074
2075 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2076                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2077 {
2078         RPC_HDR_AUTH auth_info;
2079         uint32 auth_len = p->hdr.auth_len;
2080         uint32 save_offset = prs_offset(rpc_in);
2081         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
2082         unsigned char *data = NULL;
2083         size_t data_len;
2084         unsigned char *full_packet_data = NULL;
2085         size_t full_packet_data_len;
2086         DATA_BLOB auth_blob;
2087
2088         *pstatus = NT_STATUS_OK;
2089
2090         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2091                 return True;
2092         }
2093
2094         if (!a) {
2095                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2096                 return False;
2097         }
2098
2099         /* Ensure there's enough data for an authenticated request. */
2100         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
2101                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
2102                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2103                         (unsigned int)auth_len ));
2104                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2105                 return False;
2106         }
2107
2108         /*
2109          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2110          * after the RPC header.
2111          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2112          * functions as NTLMv2 checks the rpc headers also.
2113          */
2114
2115         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2116         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2117
2118         full_packet_data = p->in_data.current_in_pdu;
2119         full_packet_data_len = p->hdr.frag_len - auth_len;
2120
2121         /* Pull the auth header and the following data into a blob. */
2122         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2123                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2124                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2125                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2126                 return False;
2127         }
2128
2129         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2130                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2131                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2132                 return False;
2133         }
2134
2135         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2136         auth_blob.length = auth_len;
2137
2138         switch (p->auth.auth_level) {
2139                 case DCERPC_AUTH_LEVEL_PRIVACY:
2140                         /* Data is encrypted. */
2141                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2142                                                         data, data_len,
2143                                                         full_packet_data,
2144                                                         full_packet_data_len,
2145                                                         &auth_blob);
2146                         if (!NT_STATUS_IS_OK(*pstatus)) {
2147                                 return False;
2148                         }
2149                         break;
2150                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2151                         /* Data is signed. */
2152                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2153                                                         data, data_len,
2154                                                         full_packet_data,
2155                                                         full_packet_data_len,
2156                                                         &auth_blob);
2157                         if (!NT_STATUS_IS_OK(*pstatus)) {
2158                                 return False;
2159                         }
2160                         break;
2161                 default:
2162                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2163                         return False;
2164         }
2165
2166         /*
2167          * Return the current pointer to the data offset.
2168          */
2169
2170         if(!prs_set_offset(rpc_in, save_offset)) {
2171                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2172                         (unsigned int)save_offset ));
2173                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2174                 return False;
2175         }
2176
2177         /*
2178          * Remember the padding length. We must remove it from the real data
2179          * stream once the sign/seal is done.
2180          */
2181
2182         *p_ss_padding_len = auth_info.auth_pad_len;
2183
2184         return True;
2185 }
2186
2187 /****************************************************************************
2188  Deal with schannel processing on an RPC request.
2189 ****************************************************************************/
2190
2191 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2192 {
2193         uint32 data_len;
2194         uint32 auth_len;
2195         uint32 save_offset = prs_offset(rpc_in);
2196         RPC_HDR_AUTH auth_info;
2197         DATA_BLOB blob;
2198         NTSTATUS status;
2199         uint8_t *data;
2200
2201         auth_len = p->hdr.auth_len;
2202
2203         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2204                         auth_len > RPC_HEADER_LEN +
2205                                         RPC_HDR_REQ_LEN +
2206                                         RPC_HDR_AUTH_LEN +
2207                                         auth_len) {
2208                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2209                 return False;
2210         }
2211
2212         /*
2213          * The following is that length of the data we must verify or unseal.
2214          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2215          * preceeding the auth_data.
2216          */
2217
2218         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2219                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2220                         (unsigned int)p->hdr.frag_len,
2221                         (unsigned int)auth_len ));
2222                 return False;
2223         }
2224
2225         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2226                 RPC_HDR_AUTH_LEN - auth_len;
2227
2228         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2229
2230         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2231                 DEBUG(0,("cannot move offset to %u.\n",
2232                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2233                 return False;
2234         }
2235
2236         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2237                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2238                 return False;
2239         }
2240
2241         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2242                 DEBUG(0,("Invalid auth info %d on schannel\n",
2243                          auth_info.auth_type));
2244                 return False;
2245         }
2246
2247         blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2248
2249         if (DEBUGLEVEL >= 10) {
2250                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2251         }
2252
2253         data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2254
2255         switch (auth_info.auth_level) {
2256         case DCERPC_AUTH_LEVEL_PRIVACY:
2257                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2258                                                 talloc_tos(),
2259                                                 true,
2260                                                 data,
2261                                                 data_len,
2262                                                 &blob);
2263                 break;
2264         case DCERPC_AUTH_LEVEL_INTEGRITY:
2265                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2266                                                 talloc_tos(),
2267                                                 false,
2268                                                 data,
2269                                                 data_len,
2270                                                 &blob);
2271                 break;
2272         default:
2273                 status = NT_STATUS_INTERNAL_ERROR;
2274                 break;
2275         }
2276
2277         if (!NT_STATUS_IS_OK(status)) {
2278                 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2279                 return false;
2280         }
2281
2282         /*
2283          * Return the current pointer to the data offset.
2284          */
2285
2286         if(!prs_set_offset(rpc_in, save_offset)) {
2287                 DEBUG(0,("failed to set offset back to %u\n",
2288                          (unsigned int)save_offset ));
2289                 return False;
2290         }
2291
2292         /*
2293          * Remember the padding length. We must remove it from the real data
2294          * stream once the sign/seal is done.
2295          */
2296
2297         *p_ss_padding_len = auth_info.auth_pad_len;
2298
2299         return True;
2300 }
2301
2302 /****************************************************************************
2303  Find the set of RPC functions associated with this context_id
2304 ****************************************************************************/
2305
2306 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2307 {
2308         PIPE_RPC_FNS *fns = NULL;
2309
2310         if ( !list ) {
2311                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2312                 return NULL;
2313         }
2314
2315         for (fns=list; fns; fns=fns->next ) {
2316                 if ( fns->context_id == context_id )
2317                         return fns;
2318         }
2319         return NULL;
2320 }
2321
2322 /****************************************************************************
2323  Memory cleanup.
2324 ****************************************************************************/
2325
2326 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2327 {
2328         PIPE_RPC_FNS *tmp = list;
2329         PIPE_RPC_FNS *tmp2;
2330
2331         while (tmp) {
2332                 tmp2 = tmp->next;
2333                 SAFE_FREE(tmp);
2334                 tmp = tmp2;
2335         }
2336
2337         return;
2338 }
2339
2340 static bool api_rpcTNP(pipes_struct *p,
2341                        const struct api_struct *api_rpc_cmds, int n_cmds);
2342
2343 /****************************************************************************
2344  Find the correct RPC function to call for this request.
2345  If the pipe is authenticated then become the correct UNIX user
2346  before doing the call.
2347 ****************************************************************************/
2348
2349 bool api_pipe_request(pipes_struct *p)
2350 {
2351         bool ret = False;
2352         bool changed_user = False;
2353         PIPE_RPC_FNS *pipe_fns;
2354
2355         if (p->pipe_bound &&
2356                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2357                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2358                 if(!become_authenticated_pipe_user(p)) {
2359                         prs_mem_free(&p->out_data.rdata);
2360                         return False;
2361                 }
2362                 changed_user = True;
2363         }
2364
2365         DEBUG(5, ("Requested \\PIPE\\%s\n",
2366                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2367
2368         /* get the set of RPC functions for this context */
2369
2370         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2371
2372         if ( pipe_fns ) {
2373                 TALLOC_CTX *frame = talloc_stackframe();
2374                 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2375                 TALLOC_FREE(frame);
2376         }
2377         else {
2378                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2379                         p->hdr_req.context_id,
2380                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2381         }
2382
2383         if (changed_user) {
2384                 unbecome_authenticated_pipe_user();
2385         }
2386
2387         return ret;
2388 }
2389
2390 /*******************************************************************
2391  Calls the underlying RPC function for a named pipe.
2392  ********************************************************************/
2393
2394 static bool api_rpcTNP(pipes_struct *p,
2395                        const struct api_struct *api_rpc_cmds, int n_cmds)
2396 {
2397         int fn_num;
2398         uint32 offset1, offset2;
2399
2400         /* interpret the command */
2401         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2402                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2403                  p->hdr_req.opnum));
2404
2405         if (DEBUGLEVEL >= 50) {
2406                 fstring name;
2407                 slprintf(name, sizeof(name)-1, "in_%s",
2408                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2409                 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2410         }
2411
2412         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2413                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2414                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2415                         break;
2416                 }
2417         }
2418
2419         if (fn_num == n_cmds) {
2420                 /*
2421                  * For an unknown RPC just return a fault PDU but
2422                  * return True to allow RPC's on the pipe to continue
2423                  * and not put the pipe into fault state. JRA.
2424                  */
2425                 DEBUG(4, ("unknown\n"));
2426                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2427                 return True;
2428         }
2429
2430         offset1 = prs_offset(&p->out_data.rdata);
2431
2432         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2433                 fn_num, api_rpc_cmds[fn_num].fn));
2434         /* do the actual command */
2435         if(!api_rpc_cmds[fn_num].fn(p)) {
2436                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2437                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2438                          api_rpc_cmds[fn_num].name));
2439                 prs_mem_free(&p->out_data.rdata);
2440                 return False;
2441         }
2442
2443         if (p->bad_handle_fault_state) {
2444                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2445                 p->bad_handle_fault_state = False;
2446                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2447                 return True;
2448         }
2449
2450         if (p->rng_fault_state) {
2451                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2452                 p->rng_fault_state = False;
2453                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2454                 return True;
2455         }
2456
2457         offset2 = prs_offset(&p->out_data.rdata);
2458         prs_set_offset(&p->out_data.rdata, offset1);
2459         if (DEBUGLEVEL >= 50) {
2460                 fstring name;
2461                 slprintf(name, sizeof(name)-1, "out_%s",
2462                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2463                 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2464         }
2465         prs_set_offset(&p->out_data.rdata, offset2);
2466
2467         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2468                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2469
2470         /* Check for buffer underflow in rpc parsing */
2471
2472         if ((DEBUGLEVEL >= 10) &&
2473             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2474                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2475                 char *data = (char *)SMB_MALLOC(data_len);
2476
2477                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2478                 if (data) {
2479                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2480                         SAFE_FREE(data);
2481                 }
2482
2483         }
2484
2485         return True;
2486 }