source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31
  32 extern struct pipe_id_info pipe_names[];
  33 extern struct current_user current_user;
  34
  35 #undef DBGC_CLASS
  36 #define DBGC_CLASS DBGC_RPC_SRV
  37
  38 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  39 {
  40         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  41
  42         if (a) {
  43                 auth_ntlmssp_end(&a);
  44         }
  45         auth->a_u.auth_ntlmssp_state = NULL;
  46 }
  47
  48 static DATA_BLOB generic_session_key(void)
  49 {
  50         return data_blob("SystemLibraryDTC", 16);
  51 }
  52
  53 /*******************************************************************
  54  Generate the next PDU to be returned from the data in p->rdata.
  55  Handle NTLMSSP.
  56  ********************************************************************/
  57
  58 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  59 {
  60         RPC_HDR_RESP hdr_resp;
  61         uint32 ss_padding_len = 0;
  62         uint32 data_space_available;
  63         uint32 data_len_left;
  64         uint32 data_len;
  65         prs_struct outgoing_pdu;
  66         NTSTATUS status;
  67         DATA_BLOB auth_blob;
  68         RPC_HDR_AUTH auth_info;
  69         uint8 auth_type, auth_level;
  70         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  71
  72         /*
  73          * If we're in the fault state, keep returning fault PDU's until
  74          * the pipe gets closed. JRA.
  75          */
  76
  77         if(p->fault_state) {
  78                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  79                 return True;
  80         }
  81
  82         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  83
  84         /* Change the incoming request header to a response. */
  85         p->hdr.pkt_type = RPC_RESPONSE;
  86
  87         /* Set up rpc header flags. */
  88         if (p->out_data.data_sent_length == 0) {
  89                 p->hdr.flags = RPC_FLG_FIRST;
  90         } else {
  91                 p->hdr.flags = 0;
  92         }
  93
  94         /*
  95          * Work out how much we can fit in a single PDU.
  96          */
  97
  98         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  99
 100         /*
 101          * Ensure there really is data left to send.
 102          */
 103
 104         if(!data_len_left) {
 105                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 106                 return False;
 107         }
 108
 109         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 110                                         RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 111
 112         /*
 113          * The amount we send is the minimum of the available
 114          * space and the amount left to send.
 115          */
 116
 117         data_len = MIN(data_len_left, data_space_available);
 118
 119         /*
 120          * Set up the alloc hint. This should be the data left to
 121          * send.
 122          */
 123
 124         hdr_resp.alloc_hint = data_len_left;
 125
 126         /*
 127          * Work out if this PDU will be the last.
 128          */
 129
 130         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 131                 p->hdr.flags |= RPC_FLG_LAST;
 132                 if (data_len_left % 8) {
 133                         ss_padding_len = 8 - (data_len_left % 8);
 134                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 135                                 ss_padding_len ));
 136                 }
 137         }
 138
 139         /*
 140          * Set up the header lengths.
 141          */
 142
 143         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 144                         data_len + ss_padding_len +
 145                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 146         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 147
 148
 149         /*
 150          * Init the parse struct to point at the outgoing
 151          * data.
 152          */
 153
 154         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 155         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 156
 157         /* Store the header in the data stream. */
 158         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 159                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 160                 prs_mem_free(&outgoing_pdu);
 161                 return False;
 162         }
 163
 164         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 165                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 166                 prs_mem_free(&outgoing_pdu);
 167                 return False;
 168         }
 169
 170         /* Copy the data into the PDU. */
 171
 172         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 173                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 174                 prs_mem_free(&outgoing_pdu);
 175                 return False;
 176         }
 177
 178         /* Copy the sign/seal padding data. */
 179         if (ss_padding_len) {
 180                 char pad[8];
 181
 182                 memset(pad, '\0', 8);
 183                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 184                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 185                                         (unsigned int)ss_padding_len));
 186                         prs_mem_free(&outgoing_pdu);
 187                         return False;
 188                 }
 189         }
 190
 191
 192         /* Now write out the auth header and null blob. */
 193         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 194                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 195         } else {
 196                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 197         }
 198         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 199                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 200         } else {
 201                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 202         }
 203
 204         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 205         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 206                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 207                 prs_mem_free(&outgoing_pdu);
 208                 return False;
 209         }
 210
 211         /* Generate the sign blob. */
 212
 213         switch (p->auth.auth_level) {
 214                 case PIPE_AUTH_LEVEL_PRIVACY:
 215                         /* Data portion is encrypted. */
 216                         status = ntlmssp_seal_packet(a->ntlmssp_state,
 217                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 218                                                         data_len + ss_padding_len,
 219                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 220                                                         (size_t)prs_offset(&outgoing_pdu),
 221                                                         &auth_blob);
 222                         if (!NT_STATUS_IS_OK(status)) {
 223                                 data_blob_free(&auth_blob);
 224                                 prs_mem_free(&outgoing_pdu);
 225                                 return False;
 226                         }
 227                         break;
 228                 case PIPE_AUTH_LEVEL_INTEGRITY:
 229                         /* Data is signed. */
 230                         status = ntlmssp_sign_packet(a->ntlmssp_state,
 231                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 232                                                         data_len + ss_padding_len,
 233                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 234                                                         (size_t)prs_offset(&outgoing_pdu),
 235                                                         &auth_blob);
 236                         if (!NT_STATUS_IS_OK(status)) {
 237                                 data_blob_free(&auth_blob);
 238                                 prs_mem_free(&outgoing_pdu);
 239                                 return False;
 240                         }
 241                         break;
 242                 default:
 243                         prs_mem_free(&outgoing_pdu);
 244                         return False;
 245         }
 246
 247         /* Append the auth blob. */
 248         if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
 249                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 250                                 (unsigned int)NTLMSSP_SIG_SIZE));
 251                 data_blob_free(&auth_blob);
 252                 prs_mem_free(&outgoing_pdu);
 253                 return False;
 254         }
 255
 256         data_blob_free(&auth_blob);
 257
 258         /*
 259          * Setup the counts for this PDU.
 260          */
 261
 262         p->out_data.data_sent_length += data_len;
 263         p->out_data.current_pdu_len = p->hdr.frag_len;
 264         p->out_data.current_pdu_sent = 0;
 265
 266         prs_mem_free(&outgoing_pdu);
 267         return True;
 268 }
 269
 270 /*******************************************************************
 271  Generate the next PDU to be returned from the data in p->rdata.
 272  Return an schannel authenticated fragment.
 273  ********************************************************************/
 274
 275 static bool create_next_pdu_schannel(pipes_struct *p)
 276 {
 277         RPC_HDR_RESP hdr_resp;
 278         uint32 ss_padding_len = 0;
 279         uint32 data_len;
 280         uint32 data_space_available;
 281         uint32 data_len_left;
 282         prs_struct outgoing_pdu;
 283         uint32 data_pos;
 284
 285         /*
 286          * If we're in the fault state, keep returning fault PDU's until
 287          * the pipe gets closed. JRA.
 288          */
 289
 290         if(p->fault_state) {
 291                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 292                 return True;
 293         }
 294
 295         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 296
 297         /* Change the incoming request header to a response. */
 298         p->hdr.pkt_type = RPC_RESPONSE;
 299
 300         /* Set up rpc header flags. */
 301         if (p->out_data.data_sent_length == 0) {
 302                 p->hdr.flags = RPC_FLG_FIRST;
 303         } else {
 304                 p->hdr.flags = 0;
 305         }
 306
 307         /*
 308          * Work out how much we can fit in a single PDU.
 309          */
 310
 311         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 312
 313         /*
 314          * Ensure there really is data left to send.
 315          */
 316
 317         if(!data_len_left) {
 318                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 319                 return False;
 320         }
 321
 322         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 323                                         RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 324
 325         /*
 326          * The amount we send is the minimum of the available
 327          * space and the amount left to send.
 328          */
 329
 330         data_len = MIN(data_len_left, data_space_available);
 331
 332         /*
 333          * Set up the alloc hint. This should be the data left to
 334          * send.
 335          */
 336
 337         hdr_resp.alloc_hint = data_len_left;
 338
 339         /*
 340          * Work out if this PDU will be the last.
 341          */
 342
 343         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 344                 p->hdr.flags |= RPC_FLG_LAST;
 345                 if (data_len_left % 8) {
 346                         ss_padding_len = 8 - (data_len_left % 8);
 347                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 348                                 ss_padding_len ));
 349                 }
 350         }
 351
 352         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 353                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 354         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 355
 356         /*
 357          * Init the parse struct to point at the outgoing
 358          * data.
 359          */
 360
 361         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 362         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 363
 364         /* Store the header in the data stream. */
 365         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 366                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 367                 prs_mem_free(&outgoing_pdu);
 368                 return False;
 369         }
 370
 371         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 372                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 373                 prs_mem_free(&outgoing_pdu);
 374                 return False;
 375         }
 376
 377         /* Store the current offset. */
 378         data_pos = prs_offset(&outgoing_pdu);
 379
 380         /* Copy the data into the PDU. */
 381
 382         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 383                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 384                 prs_mem_free(&outgoing_pdu);
 385                 return False;
 386         }
 387
 388         /* Copy the sign/seal padding data. */
 389         if (ss_padding_len) {
 390                 char pad[8];
 391                 memset(pad, '\0', 8);
 392                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 393                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 394                         prs_mem_free(&outgoing_pdu);
 395                         return False;
 396                 }
 397         }
 398
 399         {
 400                 /*
 401                  * Schannel processing.
 402                  */
 403                 char *data;
 404                 RPC_HDR_AUTH auth_info;
 405                 RPC_AUTH_SCHANNEL_CHK verf;
 406
 407                 data = prs_data_p(&outgoing_pdu) + data_pos;
 408                 /* Check it's the type of reply we were expecting to decode */
 409
 410                 init_rpc_hdr_auth(&auth_info,
 411                                 RPC_SCHANNEL_AUTH_TYPE,
 412                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 413                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 414                                 ss_padding_len, 1);
 415
 416                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 417                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 418                         prs_mem_free(&outgoing_pdu);
 419                         return False;
 420                 }
 421
 422                 schannel_encode(p->auth.a_u.schannel_auth,
 423                               p->auth.auth_level,
 424                               SENDER_IS_ACCEPTOR,
 425                               &verf, data, data_len + ss_padding_len);
 426
 427                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 428                                 &verf, &outgoing_pdu, 0)) {
 429                         prs_mem_free(&outgoing_pdu);
 430                         return False;
 431                 }
 432
 433                 p->auth.a_u.schannel_auth->seq_num++;
 434         }
 435
 436         /*
 437          * Setup the counts for this PDU.
 438          */
 439
 440         p->out_data.data_sent_length += data_len;
 441         p->out_data.current_pdu_len = p->hdr.frag_len;
 442         p->out_data.current_pdu_sent = 0;
 443
 444         prs_mem_free(&outgoing_pdu);
 445         return True;
 446 }
 447
 448 /*******************************************************************
 449  Generate the next PDU to be returned from the data in p->rdata.
 450  No authentication done.
 451 ********************************************************************/
 452
 453 static bool create_next_pdu_noauth(pipes_struct *p)
 454 {
 455         RPC_HDR_RESP hdr_resp;
 456         uint32 data_len;
 457         uint32 data_space_available;
 458         uint32 data_len_left;
 459         prs_struct outgoing_pdu;
 460
 461         /*
 462          * If we're in the fault state, keep returning fault PDU's until
 463          * the pipe gets closed. JRA.
 464          */
 465
 466         if(p->fault_state) {
 467                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 468                 return True;
 469         }
 470
 471         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 472
 473         /* Change the incoming request header to a response. */
 474         p->hdr.pkt_type = RPC_RESPONSE;
 475
 476         /* Set up rpc header flags. */
 477         if (p->out_data.data_sent_length == 0) {
 478                 p->hdr.flags = RPC_FLG_FIRST;
 479         } else {
 480                 p->hdr.flags = 0;
 481         }
 482
 483         /*
 484          * Work out how much we can fit in a single PDU.
 485          */
 486
 487         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 488
 489         /*
 490          * Ensure there really is data left to send.
 491          */
 492
 493         if(!data_len_left) {
 494                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 495                 return False;
 496         }
 497
 498         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 499
 500         /*
 501          * The amount we send is the minimum of the available
 502          * space and the amount left to send.
 503          */
 504
 505         data_len = MIN(data_len_left, data_space_available);
 506
 507         /*
 508          * Set up the alloc hint. This should be the data left to
 509          * send.
 510          */
 511
 512         hdr_resp.alloc_hint = data_len_left;
 513
 514         /*
 515          * Work out if this PDU will be the last.
 516          */
 517
 518         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 519                 p->hdr.flags |= RPC_FLG_LAST;
 520         }
 521
 522         /*
 523          * Set up the header lengths.
 524          */
 525
 526         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 527         p->hdr.auth_len = 0;
 528
 529         /*
 530          * Init the parse struct to point at the outgoing
 531          * data.
 532          */
 533
 534         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 535         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 536
 537         /* Store the header in the data stream. */
 538         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 539                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 540                 prs_mem_free(&outgoing_pdu);
 541                 return False;
 542         }
 543
 544         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 545                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 546                 prs_mem_free(&outgoing_pdu);
 547                 return False;
 548         }
 549
 550         /* Copy the data into the PDU. */
 551
 552         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 553                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 554                 prs_mem_free(&outgoing_pdu);
 555                 return False;
 556         }
 557
 558         /*
 559          * Setup the counts for this PDU.
 560          */
 561
 562         p->out_data.data_sent_length += data_len;
 563         p->out_data.current_pdu_len = p->hdr.frag_len;
 564         p->out_data.current_pdu_sent = 0;
 565
 566         prs_mem_free(&outgoing_pdu);
 567         return True;
 568 }
 569
 570 /*******************************************************************
 571  Generate the next PDU to be returned from the data in p->rdata.
 572 ********************************************************************/
 573
 574 bool create_next_pdu(pipes_struct *p)
 575 {
 576         switch(p->auth.auth_level) {
 577                 case PIPE_AUTH_LEVEL_NONE:
 578                 case PIPE_AUTH_LEVEL_CONNECT:
 579                         /* This is incorrect for auth level connect. Fixme. JRA */
 580                         return create_next_pdu_noauth(p);
 581
 582                 default:
 583                         switch(p->auth.auth_type) {
 584                                 case PIPE_AUTH_TYPE_NTLMSSP:
 585                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 586                                         return create_next_pdu_ntlmssp(p);
 587                                 case PIPE_AUTH_TYPE_SCHANNEL:
 588                                         return create_next_pdu_schannel(p);
 589                                 default:
 590                                         break;
 591                         }
 592         }
 593
 594         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 595                         (unsigned int)p->auth.auth_level,
 596                         (unsigned int)p->auth.auth_type));
 597         return False;
 598 }
 599
 600 /*******************************************************************
 601  Process an NTLMSSP authentication response.
 602  If this function succeeds, the user has been authenticated
 603  and their domain, name and calling workstation stored in
 604  the pipe struct.
 605 *******************************************************************/
 606
 607 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 608 {
 609         DATA_BLOB session_key, reply;
 610         NTSTATUS status;
 611         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 612         bool ret;
 613
 614         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n", p->name));
 615
 616         ZERO_STRUCT(reply);
 617
 618         /* Set up for non-authenticated user. */
 619         TALLOC_FREE(p->pipe_user.nt_user_token);
 620         p->pipe_user.ut.ngroups = 0;
 621         SAFE_FREE( p->pipe_user.ut.groups);
 622
 623         /* this has to be done as root in order to verify the password */
 624         become_root();
 625         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 626         unbecome_root();
 627
 628         /* Don't generate a reply. */
 629         data_blob_free(&reply);
 630
 631         if (!NT_STATUS_IS_OK(status)) {
 632                 return False;
 633         }
 634
 635         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 636            ensure the underlying NTLMSSP flags are also set. If not we should
 637            refuse the bind. */
 638
 639         if (p->auth.auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
 640                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 641                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 642                                 "but client declined signing.\n",
 643                                         p->name ));
 644                         return False;
 645                 }
 646         }
 647         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 648                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 649                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 650                                 "but client declined sealing.\n",
 651                                         p->name ));
 652                         return False;
 653                 }
 654         }
 655
 656         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 657                   "workstation: %s\n", a->ntlmssp_state->user,
 658                   a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
 659
 660         /*
 661          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 662          */
 663
 664         p->pipe_user.ut.uid = a->server_info->utok.uid;
 665         p->pipe_user.ut.gid = a->server_info->utok.gid;
 666
 667         p->pipe_user.ut.ngroups = a->server_info->utok.ngroups;
 668         if (p->pipe_user.ut.ngroups) {
 669                 if (!(p->pipe_user.ut.groups = (gid_t *)memdup(
 670                               a->server_info->utok.groups,
 671                               sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
 672                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 673                         return False;
 674                 }
 675         }
 676
 677         if (a->server_info->ptok) {
 678                 p->pipe_user.nt_user_token =
 679                         dup_nt_token(NULL, a->server_info->ptok);
 680         } else {
 681                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 682                 p->pipe_user.nt_user_token = NULL;
 683                 return False;
 684         }
 685
 686         TALLOC_FREE(p->server_info);
 687
 688         p->server_info = copy_serverinfo(p, a->server_info);
 689         if (p->server_info == NULL) {
 690                 DEBUG(0, ("copy_serverinfo failed\n"));
 691                 return false;
 692         }
 693
 694         /*
 695          * We're an authenticated bind over smb, so the session key needs to
 696          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 697          * does. See the RPC-SAMBA3SESSIONKEY.
 698          */
 699
 700         session_key = generic_session_key();
 701         if (session_key.data == NULL) {
 702                 return False;
 703         }
 704
 705         ret = server_info_set_session_key(p->server_info, session_key);
 706
 707         data_blob_free(&session_key);
 708
 709         return True;
 710 }
 711
 712 /*******************************************************************
 713  The switch table for the pipe names and the functions to handle them.
 714 *******************************************************************/
 715
 716 struct rpc_table {
 717         struct {
 718                 const char *clnt;
 719                 const char *srv;
 720         } pipe;
 721         const struct api_struct *cmds;
 722         int n_cmds;
 723 };
 724
 725 static struct rpc_table *rpc_lookup;
 726 static int rpc_lookup_size;
 727
 728 /*******************************************************************
 729  This is the "stage3" NTLMSSP response after a bind request and reply.
 730 *******************************************************************/
 731
 732 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 733 {
 734         RPC_HDR_AUTH auth_info;
 735         uint32 pad;
 736         DATA_BLOB blob;
 737
 738         ZERO_STRUCT(blob);
 739
 740         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 741
 742         if (p->hdr.auth_len == 0) {
 743                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 744                 goto err;
 745         }
 746
 747         /* 4 bytes padding. */
 748         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 749                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 750                 goto err;
 751         }
 752
 753         /*
 754          * Decode the authentication verifier response.
 755          */
 756
 757         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 758                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 759                 goto err;
 760         }
 761
 762         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 763                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 764                         (unsigned int)auth_info.auth_type ));
 765                 return False;
 766         }
 767
 768         blob = data_blob(NULL,p->hdr.auth_len);
 769
 770         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 771                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 772                         (unsigned int)p->hdr.auth_len ));
 773                 goto err;
 774         }
 775
 776         /*
 777          * The following call actually checks the challenge/response data.
 778          * for correctness against the given DOMAIN\user name.
 779          */
 780
 781         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 782                 goto err;
 783         }
 784
 785         data_blob_free(&blob);
 786
 787         p->pipe_bound = True;
 788
 789         return True;
 790
 791  err:
 792
 793         data_blob_free(&blob);
 794         free_pipe_ntlmssp_auth_data(&p->auth);
 795         p->auth.a_u.auth_ntlmssp_state = NULL;
 796
 797         return False;
 798 }
 799
 800 /*******************************************************************
 801  Marshall a bind_nak pdu.
 802 *******************************************************************/
 803
 804 static bool setup_bind_nak(pipes_struct *p)
 805 {
 806         prs_struct outgoing_rpc;
 807         RPC_HDR nak_hdr;
 808         uint16 zero = 0;
 809
 810         /* Free any memory in the current return data buffer. */
 811         prs_mem_free(&p->out_data.rdata);
 812
 813         /*
 814          * Marshall directly into the outgoing PDU space. We
 815          * must do this as we need to set to the bind response
 816          * header and are never sending more than one PDU here.
 817          */
 818
 819         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
 820         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 821
 822         /*
 823          * Initialize a bind_nak header.
 824          */
 825
 826         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 827                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 828
 829         /*
 830          * Marshall the header into the outgoing PDU.
 831          */
 832
 833         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 834                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 835                 prs_mem_free(&outgoing_rpc);
 836                 return False;
 837         }
 838
 839         /*
 840          * Now add the reject reason.
 841          */
 842
 843         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 844                 prs_mem_free(&outgoing_rpc);
 845                 return False;
 846         }
 847
 848         p->out_data.data_sent_length = 0;
 849         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 850         p->out_data.current_pdu_sent = 0;
 851
 852         if (p->auth.auth_data_free_func) {
 853                 (*p->auth.auth_data_free_func)(&p->auth);
 854         }
 855         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 856         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 857         p->pipe_bound = False;
 858
 859         return True;
 860 }
 861
 862 /*******************************************************************
 863  Marshall a fault pdu.
 864 *******************************************************************/
 865
 866 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 867 {
 868         prs_struct outgoing_pdu;
 869         RPC_HDR fault_hdr;
 870         RPC_HDR_RESP hdr_resp;
 871         RPC_HDR_FAULT fault_resp;
 872
 873         /* Free any memory in the current return data buffer. */
 874         prs_mem_free(&p->out_data.rdata);
 875
 876         /*
 877          * Marshall directly into the outgoing PDU space. We
 878          * must do this as we need to set to the bind response
 879          * header and are never sending more than one PDU here.
 880          */
 881
 882         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 883         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 884
 885         /*
 886          * Initialize a fault header.
 887          */
 888
 889         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 890             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 891
 892         /*
 893          * Initialize the HDR_RESP and FAULT parts of the PDU.
 894          */
 895
 896         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 897
 898         fault_resp.status = status;
 899         fault_resp.reserved = 0;
 900
 901         /*
 902          * Marshall the header into the outgoing PDU.
 903          */
 904
 905         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 906                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 907                 prs_mem_free(&outgoing_pdu);
 908                 return False;
 909         }
 910
 911         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 912                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 913                 prs_mem_free(&outgoing_pdu);
 914                 return False;
 915         }
 916
 917         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 918                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 919                 prs_mem_free(&outgoing_pdu);
 920                 return False;
 921         }
 922
 923         p->out_data.data_sent_length = 0;
 924         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 925         p->out_data.current_pdu_sent = 0;
 926
 927         prs_mem_free(&outgoing_pdu);
 928         return True;
 929 }
 930
 931 #if 0
 932 /*******************************************************************
 933  Marshall a cancel_ack pdu.
 934  We should probably check the auth-verifier here.
 935 *******************************************************************/
 936
 937 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 938 {
 939         prs_struct outgoing_pdu;
 940         RPC_HDR ack_reply_hdr;
 941
 942         /* Free any memory in the current return data buffer. */
 943         prs_mem_free(&p->out_data.rdata);
 944
 945         /*
 946          * Marshall directly into the outgoing PDU space. We
 947          * must do this as we need to set to the bind response
 948          * header and are never sending more than one PDU here.
 949          */
 950
 951         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 952         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 953
 954         /*
 955          * Initialize a cancel_ack header.
 956          */
 957
 958         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 959                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 960
 961         /*
 962          * Marshall the header into the outgoing PDU.
 963          */
 964
 965         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 966                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 967                 prs_mem_free(&outgoing_pdu);
 968                 return False;
 969         }
 970
 971         p->out_data.data_sent_length = 0;
 972         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 973         p->out_data.current_pdu_sent = 0;
 974
 975         prs_mem_free(&outgoing_pdu);
 976         return True;
 977 }
 978 #endif
 979
 980 /*******************************************************************
 981  Ensure a bind request has the correct abstract & transfer interface.
 982  Used to reject unknown binds from Win2k.
 983 *******************************************************************/
 984
 985 bool check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 986                     RPC_IFACE* transfer, uint32 context_id)
 987 {
 988         char *pipe_name = p->name;
 989         int i=0;
 990         fstring pname;
 991
 992         fstrcpy(pname,"\\PIPE\\");
 993         fstrcat(pname,pipe_name);
 994
 995         DEBUG(3,("check_bind_req for %s\n", pname));
 996
 997         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 998
 999         for ( i=0; pipe_names[i].client_pipe; i++ ) {
1000                 DEBUGADD(10,("checking %s\n", pipe_names[i].client_pipe));
1001                 if ( strequal(pipe_names[i].client_pipe, pname)
1002                         && (abstract->if_version == pipe_names[i].abstr_syntax->if_version)
1003                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax->uuid, sizeof(struct GUID)) == 0)
1004                         && (transfer->if_version == pipe_names[i].trans_syntax->if_version)
1005                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax->uuid, sizeof(struct GUID)) == 0) ) {
1006                         struct api_struct       *fns = NULL;
1007                         int                     n_fns = 0;
1008                         PIPE_RPC_FNS            *context_fns;
1009
1010                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
1011                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1012                                 return False;
1013                         }
1014
1015                         /* save the RPC function table associated with this bind */
1016
1017                         get_pipe_fns(i, &fns, &n_fns);
1018
1019                         context_fns->cmds = fns;
1020                         context_fns->n_cmds = n_fns;
1021                         context_fns->context_id = context_id;
1022
1023                         /* add to the list of open contexts */
1024
1025                         DLIST_ADD( p->contexts, context_fns );
1026
1027                         break;
1028                 }
1029         }
1030
1031         if(pipe_names[i].client_pipe == NULL) {
1032                 return False;
1033         }
1034
1035         return True;
1036 }
1037
1038 /*******************************************************************
1039  Register commands to an RPC pipe
1040 *******************************************************************/
1041
1042 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
1043 {
1044         struct rpc_table *rpc_entry;
1045
1046         if (!clnt || !srv || !cmds) {
1047                 return NT_STATUS_INVALID_PARAMETER;
1048         }
1049
1050         if (version != SMB_RPC_INTERFACE_VERSION) {
1051                 DEBUG(0,("Can't register rpc commands!\n"
1052                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1053                          ", while this version of samba uses version %d!\n",
1054                          version,SMB_RPC_INTERFACE_VERSION));
1055                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1056         }
1057
1058         /* TODO:
1059          *
1060          * we still need to make sure that don't register the same commands twice!!!
1061          *
1062          * --metze
1063          */
1064
1065         /* We use a temporary variable because this call can fail and
1066            rpc_lookup will still be valid afterwards.  It could then succeed if
1067            called again later */
1068         rpc_lookup_size++;
1069         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1070         if (NULL == rpc_entry) {
1071                 rpc_lookup_size--;
1072                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1073                 return NT_STATUS_NO_MEMORY;
1074         } else {
1075                 rpc_lookup = rpc_entry;
1076         }
1077
1078         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1079         ZERO_STRUCTP(rpc_entry);
1080         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1081         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1082         rpc_entry->cmds = cmds;
1083         rpc_entry->n_cmds = size;
1084
1085         return NT_STATUS_OK;
1086 }
1087
1088 /*******************************************************************
1089  Handle a SPNEGO krb5 bind auth.
1090 *******************************************************************/
1091
1092 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1093                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1094 {
1095         return False;
1096 }
1097
1098 /*******************************************************************
1099  Handle the first part of a SPNEGO bind auth.
1100 *******************************************************************/
1101
1102 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1103                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1104 {
1105         DATA_BLOB blob;
1106         DATA_BLOB secblob;
1107         DATA_BLOB response;
1108         DATA_BLOB chal;
1109         char *OIDs[ASN1_MAX_OIDS];
1110         int i;
1111         NTSTATUS status;
1112         bool got_kerberos_mechanism = false;
1113         AUTH_NTLMSSP_STATE *a = NULL;
1114         RPC_HDR_AUTH auth_info;
1115
1116         ZERO_STRUCT(secblob);
1117         ZERO_STRUCT(chal);
1118         ZERO_STRUCT(response);
1119
1120         /* Grab the SPNEGO blob. */
1121         blob = data_blob(NULL,p->hdr.auth_len);
1122
1123         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1124                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1125                         (unsigned int)p->hdr.auth_len ));
1126                 goto err;
1127         }
1128
1129         if (blob.data[0] != ASN1_APPLICATION(0)) {
1130                 goto err;
1131         }
1132
1133         /* parse out the OIDs and the first sec blob */
1134         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1135                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1136                 goto err;
1137         }
1138
1139         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1140                 got_kerberos_mechanism = true;
1141         }
1142
1143         for (i=0;OIDs[i];i++) {
1144                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1145                 SAFE_FREE(OIDs[i]);
1146         }
1147         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1148
1149         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1150                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1151                 data_blob_free(&secblob);
1152                 data_blob_free(&blob);
1153                 return ret;
1154         }
1155
1156         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1157                 /* Free any previous auth type. */
1158                 free_pipe_ntlmssp_auth_data(&p->auth);
1159         }
1160
1161         if (!got_kerberos_mechanism) {
1162                 /* Initialize the NTLM engine. */
1163                 status = auth_ntlmssp_start(&a);
1164                 if (!NT_STATUS_IS_OK(status)) {
1165                         goto err;
1166                 }
1167
1168                 /*
1169                  * Pass the first security blob of data to it.
1170                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1171                  * which means we need another packet to complete the bind.
1172                  */
1173
1174                 status = auth_ntlmssp_update(a, secblob, &chal);
1175
1176                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1177                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1178                         goto err;
1179                 }
1180
1181                 /* Generate the response blob we need for step 2 of the bind. */
1182                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1183         } else {
1184                 /*
1185                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1186                  * code to process follow-up packets is not complete
1187                  * yet. JRA.
1188                  */
1189                 response = spnego_gen_auth_response(NULL,
1190                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1191                                         OID_NTLMSSP);
1192         }
1193
1194         /* Copy the blob into the pout_auth parse struct */
1195         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1196         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1197                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1198                 goto err;
1199         }
1200
1201         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1202                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1203                 goto err;
1204         }
1205
1206         p->auth.a_u.auth_ntlmssp_state = a;
1207         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1208         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1209
1210         data_blob_free(&blob);
1211         data_blob_free(&secblob);
1212         data_blob_free(&chal);
1213         data_blob_free(&response);
1214
1215         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1216         return True;
1217
1218  err:
1219
1220         data_blob_free(&blob);
1221         data_blob_free(&secblob);
1222         data_blob_free(&chal);
1223         data_blob_free(&response);
1224
1225         p->auth.a_u.auth_ntlmssp_state = NULL;
1226
1227         return False;
1228 }
1229
1230 /*******************************************************************
1231  Handle the second part of a SPNEGO bind auth.
1232 *******************************************************************/
1233
1234 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1235                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1236 {
1237         RPC_HDR_AUTH auth_info;
1238         DATA_BLOB spnego_blob;
1239         DATA_BLOB auth_blob;
1240         DATA_BLOB auth_reply;
1241         DATA_BLOB response;
1242         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1243
1244         ZERO_STRUCT(spnego_blob);
1245         ZERO_STRUCT(auth_blob);
1246         ZERO_STRUCT(auth_reply);
1247         ZERO_STRUCT(response);
1248
1249         /*
1250          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1251          * fail here as 'a' == NULL.
1252          */
1253         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1254                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1255                 goto err;
1256         }
1257
1258         /* Grab the SPNEGO blob. */
1259         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1260
1261         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1262                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1263                         (unsigned int)p->hdr.auth_len ));
1264                 goto err;
1265         }
1266
1267         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1268                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1269                 goto err;
1270         }
1271
1272         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1273                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1274                 goto err;
1275         }
1276
1277         /*
1278          * The following call actually checks the challenge/response data.
1279          * for correctness against the given DOMAIN\user name.
1280          */
1281
1282         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1283                 goto err;
1284         }
1285
1286         data_blob_free(&spnego_blob);
1287         data_blob_free(&auth_blob);
1288
1289         /* Generate the spnego "accept completed" blob - no incoming data. */
1290         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1291
1292         /* Copy the blob into the pout_auth parse struct */
1293         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1294         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1295                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1296                 goto err;
1297         }
1298
1299         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1300                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1301                 goto err;
1302         }
1303
1304         data_blob_free(&auth_reply);
1305         data_blob_free(&response);
1306
1307         p->pipe_bound = True;
1308
1309         return True;
1310
1311  err:
1312
1313         data_blob_free(&spnego_blob);
1314         data_blob_free(&auth_blob);
1315         data_blob_free(&auth_reply);
1316         data_blob_free(&response);
1317
1318         free_pipe_ntlmssp_auth_data(&p->auth);
1319         p->auth.a_u.auth_ntlmssp_state = NULL;
1320
1321         return False;
1322 }
1323
1324 /*******************************************************************
1325  Handle an schannel bind auth.
1326 *******************************************************************/
1327
1328 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1329                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1330 {
1331         RPC_HDR_AUTH auth_info;
1332         RPC_AUTH_SCHANNEL_NEG neg;
1333         RPC_AUTH_VERIFIER auth_verifier;
1334         bool ret;
1335         struct dcinfo *pdcinfo;
1336         uint32 flags;
1337         DATA_BLOB session_key;
1338
1339         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1340                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1341                 return False;
1342         }
1343
1344         /*
1345          * The neg.myname key here must match the remote computer name
1346          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1347          * operations that use credentials.
1348          */
1349
1350         become_root();
1351         ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &pdcinfo);
1352         unbecome_root();
1353
1354         if (!ret) {
1355                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1356                 return False;
1357         }
1358
1359         p->auth.a_u.schannel_auth = talloc(p, struct schannel_auth_struct);
1360         if (!p->auth.a_u.schannel_auth) {
1361                 TALLOC_FREE(pdcinfo);
1362                 return False;
1363         }
1364
1365         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1366         memcpy(p->auth.a_u.schannel_auth->sess_key, pdcinfo->sess_key,
1367                         sizeof(pdcinfo->sess_key));
1368
1369         TALLOC_FREE(pdcinfo);
1370
1371         p->auth.a_u.schannel_auth->seq_num = 0;
1372
1373         /*
1374          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1375          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1376          * struct of the person who opened the pipe. I need to test this further. JRA.
1377          *
1378          * VL. As we are mapping this to guest set the generic key
1379          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1380          * W2k3, as it does not allow schannel binds against SAMR and LSA
1381          * anymore.
1382          */
1383
1384         session_key = generic_session_key();
1385         if (session_key.data == NULL) {
1386                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1387                           " key\n"));
1388                 return false;
1389         }
1390
1391         ret = server_info_set_session_key(p->server_info, session_key);
1392
1393         data_blob_free(&session_key);
1394
1395         if (!ret) {
1396                 DEBUG(0, ("server_info_set_session_key failed\n"));
1397                 return false;
1398         }
1399
1400         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1401         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1402                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1403                 return False;
1404         }
1405
1406         /*** SCHANNEL verifier ***/
1407
1408         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1409         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1410                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1411                 return False;
1412         }
1413
1414         prs_align(pout_auth);
1415
1416         flags = 5;
1417         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1418                 return False;
1419         }
1420
1421         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1422                 neg.domain, neg.myname));
1423
1424         /* We're finished with this bind - no more packets. */
1425         p->auth.auth_data_free_func = NULL;
1426         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1427
1428         p->pipe_bound = True;
1429
1430         return True;
1431 }
1432
1433 /*******************************************************************
1434  Handle an NTLMSSP bind auth.
1435 *******************************************************************/
1436
1437 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1438                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1439 {
1440         RPC_HDR_AUTH auth_info;
1441         DATA_BLOB blob;
1442         DATA_BLOB response;
1443         NTSTATUS status;
1444         AUTH_NTLMSSP_STATE *a = NULL;
1445
1446         ZERO_STRUCT(blob);
1447         ZERO_STRUCT(response);
1448
1449         /* Grab the NTLMSSP blob. */
1450         blob = data_blob(NULL,p->hdr.auth_len);
1451
1452         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1453                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1454                         (unsigned int)p->hdr.auth_len ));
1455                 goto err;
1456         }
1457
1458         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1459                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1460                 goto err;
1461         }
1462
1463         /* We have an NTLMSSP blob. */
1464         status = auth_ntlmssp_start(&a);
1465         if (!NT_STATUS_IS_OK(status)) {
1466                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1467                         nt_errstr(status) ));
1468                 goto err;
1469         }
1470
1471         status = auth_ntlmssp_update(a, blob, &response);
1472         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1473                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1474                         nt_errstr(status) ));
1475                 goto err;
1476         }
1477
1478         data_blob_free(&blob);
1479
1480         /* Copy the blob into the pout_auth parse struct */
1481         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1482         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1483                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1484                 goto err;
1485         }
1486
1487         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1488                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1489                 goto err;
1490         }
1491
1492         p->auth.a_u.auth_ntlmssp_state = a;
1493         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1494         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1495
1496         data_blob_free(&blob);
1497         data_blob_free(&response);
1498
1499         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1500
1501         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1502         return True;
1503
1504   err:
1505
1506         data_blob_free(&blob);
1507         data_blob_free(&response);
1508
1509         free_pipe_ntlmssp_auth_data(&p->auth);
1510         p->auth.a_u.auth_ntlmssp_state = NULL;
1511         return False;
1512 }
1513
1514 /*******************************************************************
1515  Respond to a pipe bind request.
1516 *******************************************************************/
1517
1518 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1519 {
1520         RPC_HDR_BA hdr_ba;
1521         RPC_HDR_RB hdr_rb;
1522         RPC_HDR_AUTH auth_info;
1523         uint16 assoc_gid;
1524         fstring ack_pipe_name;
1525         prs_struct out_hdr_ba;
1526         prs_struct out_auth;
1527         prs_struct outgoing_rpc;
1528         int i = 0;
1529         int auth_len = 0;
1530         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1531
1532         /* No rebinds on a bound pipe - use alter context. */
1533         if (p->pipe_bound) {
1534                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1535                 return setup_bind_nak(p);
1536         }
1537
1538         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
1539
1540         /*
1541          * Marshall directly into the outgoing PDU space. We
1542          * must do this as we need to set to the bind response
1543          * header and are never sending more than one PDU here.
1544          */
1545
1546         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1547
1548         /*
1549          * Setup the memory to marshall the ba header, and the
1550          * auth footers.
1551          */
1552
1553         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1554                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1555                 prs_mem_free(&outgoing_rpc);
1556                 return False;
1557         }
1558
1559         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1560                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1561                 prs_mem_free(&outgoing_rpc);
1562                 prs_mem_free(&out_hdr_ba);
1563                 return False;
1564         }
1565
1566         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1567
1568         ZERO_STRUCT(hdr_rb);
1569
1570         /* decode the bind request */
1571
1572         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1573                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1574                          "struct.\n"));
1575                 goto err_exit;
1576         }
1577
1578         /*
1579          * Try and find the correct pipe name to ensure
1580          * that this is a pipe name we support.
1581          */
1582
1583
1584         for (i = 0; i < rpc_lookup_size; i++) {
1585                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1586                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1587                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1588                         fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1589                         break;
1590                 }
1591         }
1592
1593         if (i == rpc_lookup_size) {
1594                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1595                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1596                                 p->name ));
1597                         prs_mem_free(&outgoing_rpc);
1598                         prs_mem_free(&out_hdr_ba);
1599                         prs_mem_free(&out_auth);
1600
1601                         return setup_bind_nak(p);
1602                 }
1603
1604                 for (i = 0; i < rpc_lookup_size; i++) {
1605                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1606                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1607                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1608                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1609                                break;
1610                        }
1611                 }
1612
1613                 if (i == rpc_lookup_size) {
1614                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1615                         goto err_exit;
1616                 }
1617         }
1618
1619         /* name has to be \PIPE\xxxxx */
1620         fstrcpy(ack_pipe_name, "\\PIPE\\");
1621         fstrcat(ack_pipe_name, p->pipe_srv_name);
1622
1623         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1624
1625         /*
1626          * Check if this is an authenticated bind request.
1627          */
1628
1629         if (p->hdr.auth_len) {
1630                 /*
1631                  * Decode the authentication verifier.
1632                  */
1633
1634                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1635                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1636                         goto err_exit;
1637                 }
1638
1639                 auth_type = auth_info.auth_type;
1640
1641                 /* Work out if we have to sign or seal etc. */
1642                 switch (auth_info.auth_level) {
1643                         case RPC_AUTH_LEVEL_INTEGRITY:
1644                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1645                                 break;
1646                         case RPC_AUTH_LEVEL_PRIVACY:
1647                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1648                                 break;
1649                         default:
1650                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1651                                         (unsigned int)auth_info.auth_level ));
1652                                 goto err_exit;
1653                 }
1654         } else {
1655                 ZERO_STRUCT(auth_info);
1656         }
1657
1658         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1659
1660         switch(auth_type) {
1661                 case RPC_NTLMSSP_AUTH_TYPE:
1662                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1663                                 goto err_exit;
1664                         }
1665                         assoc_gid = 0x7a77;
1666                         break;
1667
1668                 case RPC_SCHANNEL_AUTH_TYPE:
1669                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1670                                 goto err_exit;
1671                         }
1672                         break;
1673
1674                 case RPC_SPNEGO_AUTH_TYPE:
1675                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1676                                 goto err_exit;
1677                         }
1678                         break;
1679
1680                 case RPC_ANONYMOUS_AUTH_TYPE:
1681                         /* Unauthenticated bind request. */
1682                         /* Get the authenticated pipe user from current_user */
1683                         if (!copy_current_user(&p->pipe_user, &current_user)) {
1684                                 DEBUG(10, ("Could not copy current user\n"));
1685                                 goto err_exit;
1686                         }
1687                         /* We're finished - no more packets. */
1688                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1689                         /* We must set the pipe auth_level here also. */
1690                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1691                         p->pipe_bound = True;
1692                         /* The session key was initialized from the SMB
1693                          * session in make_internal_rpc_pipe_p */
1694                         break;
1695
1696                 default:
1697                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1698                         goto err_exit;
1699         }
1700
1701         /*
1702          * Create the bind response struct.
1703          */
1704
1705         /* If the requested abstract synt uuid doesn't match our client pipe,
1706                 reject the bind_ack & set the transfer interface synt to all 0's,
1707                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1708                 unknown to NT4)
1709                 Needed when adding entries to a DACL from NT5 - SK */
1710
1711         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1712                                 hdr_rb.rpc_context[0].context_id )) {
1713                 init_rpc_hdr_ba(&hdr_ba,
1714                         RPC_MAX_PDU_FRAG_LEN,
1715                         RPC_MAX_PDU_FRAG_LEN,
1716                         assoc_gid,
1717                         ack_pipe_name,
1718                         0x1, 0x0, 0x0,
1719                         &hdr_rb.rpc_context[0].transfer[0]);
1720         } else {
1721                 RPC_IFACE null_interface;
1722                 ZERO_STRUCT(null_interface);
1723                 /* Rejection reason: abstract syntax not supported */
1724                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1725                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1726                                         ack_pipe_name, 0x1, 0x2, 0x1,
1727                                         &null_interface);
1728                 p->pipe_bound = False;
1729         }
1730
1731         /*
1732          * and marshall it.
1733          */
1734
1735         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1736                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1737                 goto err_exit;
1738         }
1739
1740         /*
1741          * Create the header, now we know the length.
1742          */
1743
1744         if (prs_offset(&out_auth)) {
1745                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1746         }
1747
1748         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1749                         p->hdr.call_id,
1750                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1751                         auth_len);
1752
1753         /*
1754          * Marshall the header into the outgoing PDU.
1755          */
1756
1757         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1758                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1759                 goto err_exit;
1760         }
1761
1762         /*
1763          * Now add the RPC_HDR_BA and any auth needed.
1764          */
1765
1766         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1767                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1768                 goto err_exit;
1769         }
1770
1771         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1772                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1773                 goto err_exit;
1774         }
1775
1776         /*
1777          * Setup the lengths for the initial reply.
1778          */
1779
1780         p->out_data.data_sent_length = 0;
1781         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1782         p->out_data.current_pdu_sent = 0;
1783
1784         prs_mem_free(&out_hdr_ba);
1785         prs_mem_free(&out_auth);
1786
1787         return True;
1788
1789   err_exit:
1790
1791         prs_mem_free(&outgoing_rpc);
1792         prs_mem_free(&out_hdr_ba);
1793         prs_mem_free(&out_auth);
1794         return setup_bind_nak(p);
1795 }
1796
1797 /****************************************************************************
1798  Deal with an alter context call. Can be third part of 3 leg auth request for
1799  SPNEGO calls.
1800 ****************************************************************************/
1801
1802 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1803 {
1804         RPC_HDR_BA hdr_ba;
1805         RPC_HDR_RB hdr_rb;
1806         RPC_HDR_AUTH auth_info;
1807         uint16 assoc_gid;
1808         fstring ack_pipe_name;
1809         prs_struct out_hdr_ba;
1810         prs_struct out_auth;
1811         prs_struct outgoing_rpc;
1812         int auth_len = 0;
1813
1814         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
1815
1816         /*
1817          * Marshall directly into the outgoing PDU space. We
1818          * must do this as we need to set to the bind response
1819          * header and are never sending more than one PDU here.
1820          */
1821
1822         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1823
1824         /*
1825          * Setup the memory to marshall the ba header, and the
1826          * auth footers.
1827          */
1828
1829         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1830                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1831                 prs_mem_free(&outgoing_rpc);
1832                 return False;
1833         }
1834
1835         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1836                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1837                 prs_mem_free(&outgoing_rpc);
1838                 prs_mem_free(&out_hdr_ba);
1839                 return False;
1840         }
1841
1842         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1843
1844         /* decode the alter context request */
1845         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1846                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1847                 goto err_exit;
1848         }
1849
1850         /* secondary address CAN be NULL
1851          * as the specs say it's ignored.
1852          * It MUST be NULL to have the spoolss working.
1853          */
1854         fstrcpy(ack_pipe_name,"");
1855
1856         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1857
1858         /*
1859          * Check if this is an authenticated alter context request.
1860          */
1861
1862         if (p->hdr.auth_len != 0) {
1863                 /*
1864                  * Decode the authentication verifier.
1865                  */
1866
1867                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1868                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1869                         goto err_exit;
1870                 }
1871
1872                 /*
1873                  * Currently only the SPNEGO auth type uses the alter ctx
1874                  * response in place of the NTLMSSP auth3 type.
1875                  */
1876
1877                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1878                         /* We can only finish if the pipe is unbound. */
1879                         if (!p->pipe_bound) {
1880                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1881                                         goto err_exit;
1882                                 }
1883                         } else {
1884                                 goto err_exit;
1885                         }
1886                 }
1887         } else {
1888                 ZERO_STRUCT(auth_info);
1889         }
1890
1891         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1892
1893         /*
1894          * Create the bind response struct.
1895          */
1896
1897         /* If the requested abstract synt uuid doesn't match our client pipe,
1898                 reject the bind_ack & set the transfer interface synt to all 0's,
1899                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1900                 unknown to NT4)
1901                 Needed when adding entries to a DACL from NT5 - SK */
1902
1903         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1904                                 hdr_rb.rpc_context[0].context_id )) {
1905                 init_rpc_hdr_ba(&hdr_ba,
1906                         RPC_MAX_PDU_FRAG_LEN,
1907                         RPC_MAX_PDU_FRAG_LEN,
1908                         assoc_gid,
1909                         ack_pipe_name,
1910                         0x1, 0x0, 0x0,
1911                         &hdr_rb.rpc_context[0].transfer[0]);
1912         } else {
1913                 RPC_IFACE null_interface;
1914                 ZERO_STRUCT(null_interface);
1915                 /* Rejection reason: abstract syntax not supported */
1916                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1917                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1918                                         ack_pipe_name, 0x1, 0x2, 0x1,
1919                                         &null_interface);
1920                 p->pipe_bound = False;
1921         }
1922
1923         /*
1924          * and marshall it.
1925          */
1926
1927         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1928                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1929                 goto err_exit;
1930         }
1931
1932         /*
1933          * Create the header, now we know the length.
1934          */
1935
1936         if (prs_offset(&out_auth)) {
1937                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1938         }
1939
1940         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1941                         p->hdr.call_id,
1942                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1943                         auth_len);
1944
1945         /*
1946          * Marshall the header into the outgoing PDU.
1947          */
1948
1949         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1950                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1951                 goto err_exit;
1952         }
1953
1954         /*
1955          * Now add the RPC_HDR_BA and any auth needed.
1956          */
1957
1958         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1959                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1960                 goto err_exit;
1961         }
1962
1963         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1964                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1965                 goto err_exit;
1966         }
1967
1968         /*
1969          * Setup the lengths for the initial reply.
1970          */
1971
1972         p->out_data.data_sent_length = 0;
1973         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1974         p->out_data.current_pdu_sent = 0;
1975
1976         prs_mem_free(&out_hdr_ba);
1977         prs_mem_free(&out_auth);
1978
1979         return True;
1980
1981   err_exit:
1982
1983         prs_mem_free(&outgoing_rpc);
1984         prs_mem_free(&out_hdr_ba);
1985         prs_mem_free(&out_auth);
1986         return setup_bind_nak(p);
1987 }
1988
1989 /****************************************************************************
1990  Deal with NTLMSSP sign & seal processing on an RPC request.
1991 ****************************************************************************/
1992
1993 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1994                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1995 {
1996         RPC_HDR_AUTH auth_info;
1997         uint32 auth_len = p->hdr.auth_len;
1998         uint32 save_offset = prs_offset(rpc_in);
1999         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
2000         unsigned char *data = NULL;
2001         size_t data_len;
2002         unsigned char *full_packet_data = NULL;
2003         size_t full_packet_data_len;
2004         DATA_BLOB auth_blob;
2005
2006         *pstatus = NT_STATUS_OK;
2007
2008         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
2009                 return True;
2010         }
2011
2012         if (!a) {
2013                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2014                 return False;
2015         }
2016
2017         /* Ensure there's enough data for an authenticated request. */
2018         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
2019                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
2020                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2021                         (unsigned int)auth_len ));
2022                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2023                 return False;
2024         }
2025
2026         /*
2027          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2028          * after the RPC header.
2029          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2030          * functions as NTLMv2 checks the rpc headers also.
2031          */
2032
2033         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2034         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2035
2036         full_packet_data = p->in_data.current_in_pdu;
2037         full_packet_data_len = p->hdr.frag_len - auth_len;
2038
2039         /* Pull the auth header and the following data into a blob. */
2040         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2041                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2042                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2043                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2044                 return False;
2045         }
2046
2047         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2048                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2049                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2050                 return False;
2051         }
2052
2053         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2054         auth_blob.length = auth_len;
2055
2056         switch (p->auth.auth_level) {
2057                 case PIPE_AUTH_LEVEL_PRIVACY:
2058                         /* Data is encrypted. */
2059                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2060                                                         data, data_len,
2061                                                         full_packet_data,
2062                                                         full_packet_data_len,
2063                                                         &auth_blob);
2064                         if (!NT_STATUS_IS_OK(*pstatus)) {
2065                                 return False;
2066                         }
2067                         break;
2068                 case PIPE_AUTH_LEVEL_INTEGRITY:
2069                         /* Data is signed. */
2070                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2071                                                         data, data_len,
2072                                                         full_packet_data,
2073                                                         full_packet_data_len,
2074                                                         &auth_blob);
2075                         if (!NT_STATUS_IS_OK(*pstatus)) {
2076                                 return False;
2077                         }
2078                         break;
2079                 default:
2080                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2081                         return False;
2082         }
2083
2084         /*
2085          * Return the current pointer to the data offset.
2086          */
2087
2088         if(!prs_set_offset(rpc_in, save_offset)) {
2089                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2090                         (unsigned int)save_offset ));
2091                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2092                 return False;
2093         }
2094
2095         /*
2096          * Remember the padding length. We must remove it from the real data
2097          * stream once the sign/seal is done.
2098          */
2099
2100         *p_ss_padding_len = auth_info.auth_pad_len;
2101
2102         return True;
2103 }
2104
2105 /****************************************************************************
2106  Deal with schannel processing on an RPC request.
2107 ****************************************************************************/
2108
2109 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2110 {
2111         uint32 data_len;
2112         uint32 auth_len;
2113         uint32 save_offset = prs_offset(rpc_in);
2114         RPC_HDR_AUTH auth_info;
2115         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2116
2117         auth_len = p->hdr.auth_len;
2118
2119         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2120                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2121                 return False;
2122         }
2123
2124         /*
2125          * The following is that length of the data we must verify or unseal.
2126          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2127          * preceeding the auth_data.
2128          */
2129
2130         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2131                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2132                         (unsigned int)p->hdr.frag_len,
2133                         (unsigned int)auth_len ));
2134                 return False;
2135         }
2136
2137         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2138                 RPC_HDR_AUTH_LEN - auth_len;
2139
2140         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2141
2142         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2143                 DEBUG(0,("cannot move offset to %u.\n",
2144                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2145                 return False;
2146         }
2147
2148         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2149                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2150                 return False;
2151         }
2152
2153         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2154                 DEBUG(0,("Invalid auth info %d on schannel\n",
2155                          auth_info.auth_type));
2156                 return False;
2157         }
2158
2159         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2160                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2161                 return False;
2162         }
2163
2164         if (!schannel_decode(p->auth.a_u.schannel_auth,
2165                            p->auth.auth_level,
2166                            SENDER_IS_INITIATOR,
2167                            &schannel_chk,
2168                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2169                 DEBUG(3,("failed to decode PDU\n"));
2170                 return False;
2171         }
2172
2173         /*
2174          * Return the current pointer to the data offset.
2175          */
2176
2177         if(!prs_set_offset(rpc_in, save_offset)) {
2178                 DEBUG(0,("failed to set offset back to %u\n",
2179                          (unsigned int)save_offset ));
2180                 return False;
2181         }
2182
2183         /* The sequence number gets incremented on both send and receive. */
2184         p->auth.a_u.schannel_auth->seq_num++;
2185
2186         /*
2187          * Remember the padding length. We must remove it from the real data
2188          * stream once the sign/seal is done.
2189          */
2190
2191         *p_ss_padding_len = auth_info.auth_pad_len;
2192
2193         return True;
2194 }
2195
2196 /****************************************************************************
2197  Return a user struct for a pipe user.
2198 ****************************************************************************/
2199
2200 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
2201 {
2202         if (p->pipe_bound &&
2203                         (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
2204                         (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2205                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
2206         } else {
2207                 memcpy(user, &current_user, sizeof(struct current_user));
2208         }
2209
2210         return user;
2211 }
2212
2213 /****************************************************************************
2214  Find the set of RPC functions associated with this context_id
2215 ****************************************************************************/
2216
2217 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2218 {
2219         PIPE_RPC_FNS *fns = NULL;
2220         PIPE_RPC_FNS *tmp = NULL;
2221
2222         if ( !list ) {
2223                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2224                 return NULL;
2225         }
2226
2227         for (tmp=list; tmp; tmp=tmp->next ) {
2228                 if ( tmp->context_id == context_id )
2229                         break;
2230         }
2231
2232         fns = tmp;
2233
2234         return fns;
2235 }
2236
2237 /****************************************************************************
2238  Memory cleanup.
2239 ****************************************************************************/
2240
2241 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2242 {
2243         PIPE_RPC_FNS *tmp = list;
2244         PIPE_RPC_FNS *tmp2;
2245
2246         while (tmp) {
2247                 tmp2 = tmp->next;
2248                 SAFE_FREE(tmp);
2249                 tmp = tmp2;
2250         }
2251
2252         return;
2253 }
2254
2255 /****************************************************************************
2256  Find the correct RPC function to call for this request.
2257  If the pipe is authenticated then become the correct UNIX user
2258  before doing the call.
2259 ****************************************************************************/
2260
2261 bool api_pipe_request(pipes_struct *p)
2262 {
2263         bool ret = False;
2264         bool changed_user = False;
2265         PIPE_RPC_FNS *pipe_fns;
2266
2267         if (p->pipe_bound &&
2268                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2269                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2270                 if(!become_authenticated_pipe_user(p)) {
2271                         prs_mem_free(&p->out_data.rdata);
2272                         return False;
2273                 }
2274                 changed_user = True;
2275         }
2276
2277         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2278
2279         /* get the set of RPC functions for this context */
2280
2281         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2282
2283         if ( pipe_fns ) {
2284                 TALLOC_CTX *frame = talloc_stackframe();
2285                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2286                 TALLOC_FREE(frame);
2287         }
2288         else {
2289                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2290                         p->hdr_req.context_id, p->name));
2291         }
2292
2293         if (changed_user) {
2294                 unbecome_authenticated_pipe_user();
2295         }
2296
2297         return ret;
2298 }
2299
2300 /*******************************************************************
2301  Calls the underlying RPC function for a named pipe.
2302  ********************************************************************/
2303
2304 bool api_rpcTNP(pipes_struct *p, const char *rpc_name,
2305                 const struct api_struct *api_rpc_cmds, int n_cmds)
2306 {
2307         int fn_num;
2308         fstring name;
2309         uint32 offset1, offset2;
2310
2311         /* interpret the command */
2312         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2313
2314         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2315         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2316
2317         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2318                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2319                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2320                         break;
2321                 }
2322         }
2323
2324         if (fn_num == n_cmds) {
2325                 /*
2326                  * For an unknown RPC just return a fault PDU but
2327                  * return True to allow RPC's on the pipe to continue
2328                  * and not put the pipe into fault state. JRA.
2329                  */
2330                 DEBUG(4, ("unknown\n"));
2331                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2332                 return True;
2333         }
2334
2335         offset1 = prs_offset(&p->out_data.rdata);
2336
2337         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2338                 fn_num, api_rpc_cmds[fn_num].fn));
2339         /* do the actual command */
2340         if(!api_rpc_cmds[fn_num].fn(p)) {
2341                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2342                 prs_mem_free(&p->out_data.rdata);
2343                 return False;
2344         }
2345
2346         if (p->bad_handle_fault_state) {
2347                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2348                 p->bad_handle_fault_state = False;
2349                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2350                 return True;
2351         }
2352
2353         if (p->rng_fault_state) {
2354                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2355                 p->rng_fault_state = False;
2356                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2357                 return True;
2358         }
2359
2360         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2361         offset2 = prs_offset(&p->out_data.rdata);
2362         prs_set_offset(&p->out_data.rdata, offset1);
2363         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2364         prs_set_offset(&p->out_data.rdata, offset2);
2365
2366         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2367
2368         /* Check for buffer underflow in rpc parsing */
2369
2370         if ((DEBUGLEVEL >= 10) &&
2371             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2372                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2373                 char *data = (char *)SMB_MALLOC(data_len);
2374
2375                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2376                 if (data) {
2377                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2378                         SAFE_FREE(data);
2379                 }
2380
2381         }
2382
2383         return True;
2384 }
2385
2386 /*******************************************************************
2387 *******************************************************************/
2388
2389 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
2390 {
2391         struct api_struct *cmds = NULL;
2392         int               n_cmds = 0;
2393
2394         switch ( idx ) {
2395                 case PI_LSARPC:
2396                         lsarpc_get_pipe_fns( &cmds, &n_cmds );
2397                         break;
2398                 case PI_DSSETUP:
2399                         dssetup_get_pipe_fns( &cmds, &n_cmds );
2400                         break;
2401                 case PI_SAMR:
2402                         samr_get_pipe_fns( &cmds, &n_cmds );
2403                         break;
2404                 case PI_NETLOGON:
2405                         netlogon_get_pipe_fns( &cmds, &n_cmds );
2406                         break;
2407                 case PI_SRVSVC:
2408                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
2409                         break;
2410                 case PI_WKSSVC:
2411                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
2412                         break;
2413                 case PI_WINREG:
2414                         winreg_get_pipe_fns( &cmds, &n_cmds );
2415                         break;
2416                 case PI_SPOOLSS:
2417                         spoolss_get_pipe_fns( &cmds, &n_cmds );
2418                         break;
2419                 case PI_NETDFS:
2420                         netdfs_get_pipe_fns( &cmds, &n_cmds );
2421                         break;
2422                 case PI_SVCCTL:
2423                         svcctl2_get_pipe_fns( &cmds, &n_cmds );
2424                         break;
2425                 case PI_EVENTLOG:
2426                         eventlog2_get_pipe_fns( &cmds, &n_cmds );
2427                         break;
2428                 case PI_NTSVCS:
2429                         ntsvcs2_get_pipe_fns( &cmds, &n_cmds );
2430                         break;
2431 #ifdef DEVELOPER
2432                 case PI_RPCECHO:
2433                         rpcecho_get_pipe_fns( &cmds, &n_cmds );
2434                         break;
2435 #endif
2436                 default:
2437                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
2438         }
2439
2440         *fns = cmds;
2441         *n_fns = n_cmds;
2442
2443         return;
2444 }