source/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Largely rewritten by Jeremy Allison             2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21
  22 #undef DBGC_CLASS
  23 #define DBGC_CLASS DBGC_RPC_CLI
  24
  25 extern struct pipe_id_info pipe_names[];
  26
  27 /********************************************************************
  28  Map internal value to wire value.
  29  ********************************************************************/
  30
  31 static int map_pipe_auth_type_to_rpc_auth_type(enum pipe_auth_type auth_type)
  32 {
  33         switch (auth_type) {
  34
  35         case PIPE_AUTH_TYPE_NONE:
  36                 return RPC_ANONYMOUS_AUTH_TYPE;
  37
  38         case PIPE_AUTH_TYPE_NTLMSSP:
  39                 return RPC_NTLMSSP_AUTH_TYPE;
  40
  41         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
  42         case PIPE_AUTH_TYPE_SPNEGO_KRB5:
  43                 return RPC_SPNEGO_AUTH_TYPE;
  44
  45         case PIPE_AUTH_TYPE_SCHANNEL:
  46                 return RPC_SCHANNEL_AUTH_TYPE;
  47
  48         case PIPE_AUTH_TYPE_KRB5:
  49                 return RPC_KRB5_AUTH_TYPE;
  50
  51         default:
  52                 DEBUG(0,("map_pipe_auth_type_to_rpc_type: unknown pipe "
  53                         "auth type %u\n",
  54                         (unsigned int)auth_type ));
  55                 break;
  56         }
  57         return -1;
  58 }
  59
  60 /********************************************************************
  61  Rpc pipe call id.
  62  ********************************************************************/
  63
  64 static uint32 get_rpc_call_id(void)
  65 {
  66         static uint32 call_id = 0;
  67         return ++call_id;
  68 }
  69
  70 /*******************************************************************
  71  Use SMBreadX to get rest of one fragment's worth of rpc data.
  72  Will expand the current_pdu struct to the correct size.
  73  ********************************************************************/
  74
  75 static NTSTATUS rpc_read(struct rpc_pipe_client *cli,
  76                         prs_struct *current_pdu,
  77                         uint32 data_to_read,
  78                         uint32 *current_pdu_offset)
  79 {
  80         size_t size = (size_t)cli->max_recv_frag;
  81         uint32 stream_offset = 0;
  82         ssize_t num_read;
  83         char *pdata;
  84         ssize_t extra_data_size = ((ssize_t)*current_pdu_offset) + ((ssize_t)data_to_read) - (ssize_t)prs_data_size(current_pdu);
  85
  86         DEBUG(5,("rpc_read: data_to_read: %u current_pdu offset: %u extra_data_size: %d\n",
  87                 (unsigned int)data_to_read, (unsigned int)*current_pdu_offset, (int)extra_data_size ));
  88
  89         /*
  90          * Grow the buffer if needed to accommodate the data to be read.
  91          */
  92
  93         if (extra_data_size > 0) {
  94                 if(!prs_force_grow(current_pdu, (uint32)extra_data_size)) {
  95                         DEBUG(0,("rpc_read: Failed to grow parse struct by %d bytes.\n", (int)extra_data_size ));
  96                         return NT_STATUS_NO_MEMORY;
  97                 }
  98                 DEBUG(5,("rpc_read: grew buffer by %d bytes to %u\n", (int)extra_data_size, prs_data_size(current_pdu) ));
  99         }
 100
 101         pdata = prs_data_p(current_pdu) + *current_pdu_offset;
 102
 103         do {
 104                 /* read data using SMBreadX */
 105                 if (size > (size_t)data_to_read) {
 106                         size = (size_t)data_to_read;
 107                 }
 108
 109                 num_read = cli_read(cli->cli, cli->fnum, pdata,
 110                                          (off_t)stream_offset, size);
 111
 112                 DEBUG(5,("rpc_read: num_read = %d, read offset: %u, to read: %u\n",
 113                         (int)num_read, (unsigned int)stream_offset, (unsigned int)data_to_read));
 114
 115                 /*
 116                  * A dos error of ERRDOS/ERRmoredata is not an error.
 117                  */
 118                 if (cli_is_dos_error(cli->cli)) {
 119                         uint32 ecode;
 120                         uint8 eclass;
 121                         cli_dos_error(cli->cli, &eclass, &ecode);
 122                         if (eclass != ERRDOS && ecode != ERRmoredata) {
 123                                 DEBUG(0,("rpc_read: DOS Error %d/%u (%s) in cli_read on pipe %s\n",
 124                                         eclass, (unsigned int)ecode,
 125                                         cli_errstr(cli->cli),
 126                                         cli->pipe_name ));
 127                                 return dos_to_ntstatus(eclass, ecode);
 128                         }
 129                 }
 130
 131                 /*
 132                  * Likewise for NT_STATUS_BUFFER_TOO_SMALL
 133                  */
 134                 if (cli_is_nt_error(cli->cli)) {
 135                         if (!NT_STATUS_EQUAL(cli_nt_error(cli->cli), NT_STATUS_BUFFER_TOO_SMALL)) {
 136                                 DEBUG(0,("rpc_read: Error (%s) in cli_read on pipe %s\n",
 137                                         nt_errstr(cli_nt_error(cli->cli)),
 138                                         cli->pipe_name ));
 139                                 return cli_nt_error(cli->cli);
 140                         }
 141                 }
 142
 143                 if (num_read == -1) {
 144                         DEBUG(0,("rpc_read: Error - cli_read on pipe %s returned -1\n",
 145                                 cli->pipe_name ));
 146                         return cli_get_nt_error(cli->cli);
 147                 }
 148
 149                 data_to_read -= num_read;
 150                 stream_offset += num_read;
 151                 pdata += num_read;
 152
 153         } while (num_read > 0 && data_to_read > 0);
 154         /* && err == (0x80000000 | STATUS_BUFFER_OVERFLOW)); */
 155
 156         /*
 157          * Update the current offset into current_pdu by the amount read.
 158          */
 159         *current_pdu_offset += stream_offset;
 160         return NT_STATUS_OK;
 161 }
 162
 163 /****************************************************************************
 164  Try and get a PDU's worth of data from current_pdu. If not, then read more
 165  from the wire.
 166  ****************************************************************************/
 167
 168 static NTSTATUS cli_pipe_get_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr, prs_struct *current_pdu)
 169 {
 170         NTSTATUS ret = NT_STATUS_OK;
 171         uint32 current_pdu_len = prs_data_size(current_pdu);
 172
 173         /* Ensure we have at least RPC_HEADER_LEN worth of data to parse. */
 174         if (current_pdu_len < RPC_HEADER_LEN) {
 175                 /* rpc_read expands the current_pdu struct as neccessary. */
 176                 ret = rpc_read(cli, current_pdu, RPC_HEADER_LEN - current_pdu_len, &current_pdu_len);
 177                 if (!NT_STATUS_IS_OK(ret)) {
 178                         return ret;
 179                 }
 180         }
 181
 182         /* This next call sets the endian bit correctly in current_pdu. */
 183         /* We will propagate this to rbuf later. */
 184         if(!smb_io_rpc_hdr("rpc_hdr   ", prhdr, current_pdu, 0)) {
 185                 DEBUG(0,("cli_pipe_get_current_pdu: Failed to unmarshall RPC_HDR.\n"));
 186                 return NT_STATUS_BUFFER_TOO_SMALL;
 187         }
 188
 189         /* Ensure we have frag_len bytes of data. */
 190         if (current_pdu_len < prhdr->frag_len) {
 191                 /* rpc_read expands the current_pdu struct as neccessary. */
 192                 ret = rpc_read(cli, current_pdu, (uint32)prhdr->frag_len - current_pdu_len, &current_pdu_len);
 193                 if (!NT_STATUS_IS_OK(ret)) {
 194                         return ret;
 195                 }
 196         }
 197
 198         if (current_pdu_len < prhdr->frag_len) {
 199                 return NT_STATUS_BUFFER_TOO_SMALL;
 200         }
 201
 202         return NT_STATUS_OK;
 203 }
 204
 205 /****************************************************************************
 206  NTLMSSP specific sign/seal.
 207  Virtually identical to rpc_server/srv_pipe.c:api_pipe_ntlmssp_auth_process.
 208  In fact I should probably abstract these into identical pieces of code... JRA.
 209  ****************************************************************************/
 210
 211 static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 212                                 prs_struct *current_pdu,
 213                                 uint8 *p_ss_padding_len)
 214 {
 215         RPC_HDR_AUTH auth_info;
 216         uint32 save_offset = prs_offset(current_pdu);
 217         uint32 auth_len = prhdr->auth_len;
 218         NTLMSSP_STATE *ntlmssp_state = cli->auth.a_u.ntlmssp_state;
 219         unsigned char *data = NULL;
 220         size_t data_len;
 221         unsigned char *full_packet_data = NULL;
 222         size_t full_packet_data_len;
 223         DATA_BLOB auth_blob;
 224         NTSTATUS status;
 225
 226         if (cli->auth.auth_level == PIPE_AUTH_LEVEL_NONE || cli->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
 227                 return NT_STATUS_OK;
 228         }
 229
 230         if (!ntlmssp_state) {
 231                 return NT_STATUS_INVALID_PARAMETER;
 232         }
 233
 234         /* Ensure there's enough data for an authenticated response. */
 235         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
 236                         (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
 237                 DEBUG(0,("cli_pipe_verify_ntlmssp: auth_len %u is too large.\n",
 238                         (unsigned int)auth_len ));
 239                 return NT_STATUS_BUFFER_TOO_SMALL;
 240         }
 241
 242         /*
 243          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
 244          * after the RPC header.
 245          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
 246          * functions as NTLMv2 checks the rpc headers also.
 247          */
 248
 249         data = (unsigned char *)(prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN);
 250         data_len = (size_t)(prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len);
 251
 252         full_packet_data = (unsigned char *)prs_data_p(current_pdu);
 253         full_packet_data_len = prhdr->frag_len - auth_len;
 254
 255         /* Pull the auth header and the following data into a blob. */
 256         if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
 257                 DEBUG(0,("cli_pipe_verify_ntlmssp: cannot move offset to %u.\n",
 258                         (unsigned int)RPC_HEADER_LEN + (unsigned int)RPC_HDR_RESP_LEN + (unsigned int)data_len ));
 259                 return NT_STATUS_BUFFER_TOO_SMALL;
 260         }
 261
 262         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
 263                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall RPC_HDR_AUTH.\n"));
 264                 return NT_STATUS_BUFFER_TOO_SMALL;
 265         }
 266
 267         auth_blob.data = (unsigned char *)prs_data_p(current_pdu) + prs_offset(current_pdu);
 268         auth_blob.length = auth_len;
 269
 270         switch (cli->auth.auth_level) {
 271                 case PIPE_AUTH_LEVEL_PRIVACY:
 272                         /* Data is encrypted. */
 273                         status = ntlmssp_unseal_packet(ntlmssp_state,
 274                                                         data, data_len,
 275                                                         full_packet_data,
 276                                                         full_packet_data_len,
 277                                                         &auth_blob);
 278                         if (!NT_STATUS_IS_OK(status)) {
 279                                 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unseal "
 280                                         "packet from remote machine %s on pipe %s "
 281                                         "fnum 0x%x. Error was %s.\n",
 282                                         cli->desthost,
 283                                         cli->pipe_name,
 284                                         (unsigned int)cli->fnum,
 285                                         nt_errstr(status) ));
 286                                 return status;
 287                         }
 288                         break;
 289                 case PIPE_AUTH_LEVEL_INTEGRITY:
 290                         /* Data is signed. */
 291                         status = ntlmssp_check_packet(ntlmssp_state,
 292                                                         data, data_len,
 293                                                         full_packet_data,
 294                                                         full_packet_data_len,
 295                                                         &auth_blob);
 296                         if (!NT_STATUS_IS_OK(status)) {
 297                                 DEBUG(0,("cli_pipe_verify_ntlmssp: check signing failed on "
 298                                         "packet from remote machine %s on pipe %s "
 299                                         "fnum 0x%x. Error was %s.\n",
 300                                         cli->desthost,
 301                                         cli->pipe_name,
 302                                         (unsigned int)cli->fnum,
 303                                         nt_errstr(status) ));
 304                                 return status;
 305                         }
 306                         break;
 307                 default:
 308                         DEBUG(0,("cli_pipe_verify_ntlmssp: unknown internal auth level %d\n",
 309                                 cli->auth.auth_level ));
 310                         return NT_STATUS_INVALID_INFO_CLASS;
 311         }
 312
 313         /*
 314          * Return the current pointer to the data offset.
 315          */
 316
 317         if(!prs_set_offset(current_pdu, save_offset)) {
 318                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
 319                         (unsigned int)save_offset ));
 320                 return NT_STATUS_BUFFER_TOO_SMALL;
 321         }
 322
 323         /*
 324          * Remember the padding length. We must remove it from the real data
 325          * stream once the sign/seal is done.
 326          */
 327
 328         *p_ss_padding_len = auth_info.auth_pad_len;
 329
 330         return NT_STATUS_OK;
 331 }
 332
 333 /****************************************************************************
 334  schannel specific sign/seal.
 335  ****************************************************************************/
 336
 337 static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 338                                 prs_struct *current_pdu,
 339                                 uint8 *p_ss_padding_len)
 340 {
 341         RPC_HDR_AUTH auth_info;
 342         RPC_AUTH_SCHANNEL_CHK schannel_chk;
 343         uint32 auth_len = prhdr->auth_len;
 344         uint32 save_offset = prs_offset(current_pdu);
 345         struct schannel_auth_struct *schannel_auth = cli->auth.a_u.schannel_auth;
 346         uint32 data_len;
 347
 348         if (cli->auth.auth_level == PIPE_AUTH_LEVEL_NONE || cli->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
 349                 return NT_STATUS_OK;
 350         }
 351
 352         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
 353                 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u.\n", (unsigned int)auth_len ));
 354                 return NT_STATUS_INVALID_PARAMETER;
 355         }
 356
 357         if (!schannel_auth) {
 358                 return NT_STATUS_INVALID_PARAMETER;
 359         }
 360
 361         /* Ensure there's enough data for an authenticated response. */
 362         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
 363                         (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
 364                 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u is too large.\n",
 365                         (unsigned int)auth_len ));
 366                 return NT_STATUS_INVALID_PARAMETER;
 367         }
 368
 369         data_len = prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 370
 371         if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
 372                 DEBUG(0,("cli_pipe_verify_schannel: cannot move offset to %u.\n",
 373                         (unsigned int)RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len ));
 374                 return NT_STATUS_BUFFER_TOO_SMALL;
 375         }
 376
 377         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
 378                 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshall RPC_HDR_AUTH.\n"));
 379                 return NT_STATUS_BUFFER_TOO_SMALL;
 380         }
 381
 382         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
 383                 DEBUG(0,("cli_pipe_verify_schannel: Invalid auth info %d on schannel\n",
 384                         auth_info.auth_type));
 385                 return NT_STATUS_BUFFER_TOO_SMALL;
 386         }
 387
 388         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 389                                 &schannel_chk, current_pdu, 0)) {
 390                 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
 391                 return NT_STATUS_BUFFER_TOO_SMALL;
 392         }
 393
 394         if (!schannel_decode(schannel_auth,
 395                         cli->auth.auth_level,
 396                         SENDER_IS_ACCEPTOR,
 397                         &schannel_chk,
 398                         prs_data_p(current_pdu)+RPC_HEADER_LEN+RPC_HDR_RESP_LEN,
 399                         data_len)) {
 400                 DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
 401                                 "Connection to remote machine %s "
 402                                 "pipe %s fnum 0x%x.\n",
 403                                 cli->desthost,
 404                                 cli->pipe_name,
 405                                 (unsigned int)cli->fnum ));
 406                 return NT_STATUS_INVALID_PARAMETER;
 407         }
 408
 409         /* The sequence number gets incremented on both send and receive. */
 410         schannel_auth->seq_num++;
 411
 412         /*
 413          * Return the current pointer to the data offset.
 414          */
 415
 416         if(!prs_set_offset(current_pdu, save_offset)) {
 417                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
 418                         (unsigned int)save_offset ));
 419                 return NT_STATUS_BUFFER_TOO_SMALL;
 420         }
 421
 422         /*
 423          * Remember the padding length. We must remove it from the real data
 424          * stream once the sign/seal is done.
 425          */
 426
 427         *p_ss_padding_len = auth_info.auth_pad_len;
 428
 429         return NT_STATUS_OK;
 430 }
 431
 432 /****************************************************************************
 433  Do the authentication checks on an incoming pdu. Check sign and unseal etc.
 434  ****************************************************************************/
 435
 436 static NTSTATUS cli_pipe_validate_rpc_response(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 437                                 prs_struct *current_pdu,
 438                                 uint8 *p_ss_padding_len)
 439 {
 440         NTSTATUS ret = NT_STATUS_OK;
 441
 442         /* Paranioa checks for auth_len. */
 443         if (prhdr->auth_len) {
 444                 if (prhdr->auth_len > prhdr->frag_len) {
 445                         return NT_STATUS_INVALID_PARAMETER;
 446                 }
 447
 448                 if (prhdr->auth_len + RPC_HDR_AUTH_LEN < prhdr->auth_len ||
 449                                 prhdr->auth_len + RPC_HDR_AUTH_LEN < RPC_HDR_AUTH_LEN) {
 450                         /* Integer wrap attempt. */
 451                         return NT_STATUS_INVALID_PARAMETER;
 452                 }
 453         }
 454
 455         /*
 456          * Now we have a complete RPC request PDU fragment, try and verify any auth data.
 457          */
 458
 459         switch(cli->auth.auth_type) {
 460                 case PIPE_AUTH_TYPE_NONE:
 461                         if (prhdr->auth_len) {
 462                                 DEBUG(3, ("cli_pipe_validate_rpc_response: Connection to remote machine %s "
 463                                         "pipe %s fnum 0x%x - got non-zero auth len %u.\n",
 464                                         cli->desthost,
 465                                         cli->pipe_name,
 466                                         (unsigned int)cli->fnum,
 467                                         (unsigned int)prhdr->auth_len ));
 468                                 return NT_STATUS_INVALID_PARAMETER;
 469                         }
 470                         break;
 471
 472                 case PIPE_AUTH_TYPE_NTLMSSP:
 473                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 474                         ret = cli_pipe_verify_ntlmssp(cli, prhdr, current_pdu, p_ss_padding_len);
 475                         if (!NT_STATUS_IS_OK(ret)) {
 476                                 return ret;
 477                         }
 478                         break;
 479
 480                 case PIPE_AUTH_TYPE_SCHANNEL:
 481                         ret = cli_pipe_verify_schannel(cli, prhdr, current_pdu, p_ss_padding_len);
 482                         if (!NT_STATUS_IS_OK(ret)) {
 483                                 return ret;
 484                         }
 485                         break;
 486
 487                 case PIPE_AUTH_TYPE_KRB5:
 488                 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
 489                 default:
 490                         DEBUG(3, ("cli_pipe_validate_rpc_response: Connection to remote machine %s "
 491                                 "pipe %s fnum %x - unknown internal auth type %u.\n",
 492                                 cli->desthost,
 493                                 cli->pipe_name,
 494                                 (unsigned int)cli->fnum,
 495                                 cli->auth.auth_type ));
 496                         return NT_STATUS_INVALID_INFO_CLASS;
 497         }
 498
 499         return NT_STATUS_OK;
 500 }
 501
 502 /****************************************************************************
 503  Do basic authentication checks on an incoming pdu.
 504  ****************************************************************************/
 505
 506 static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
 507                         prs_struct *current_pdu,
 508                         uint8 expected_pkt_type,
 509                         char **ppdata,
 510                         uint32 *pdata_len,
 511                         prs_struct *return_data)
 512 {
 513
 514         NTSTATUS ret = NT_STATUS_OK;
 515         uint32 current_pdu_len = prs_data_size(current_pdu);
 516
 517         if (current_pdu_len != prhdr->frag_len) {
 518                 DEBUG(5,("cli_pipe_validate_current_pdu: incorrect pdu length %u, expected %u\n",
 519                         (unsigned int)current_pdu_len, (unsigned int)prhdr->frag_len ));
 520                 return NT_STATUS_INVALID_PARAMETER;
 521         }
 522
 523         /*
 524          * Point the return values at the real data including the RPC
 525          * header. Just in case the caller wants it.
 526          */
 527         *ppdata = prs_data_p(current_pdu);
 528         *pdata_len = current_pdu_len;
 529
 530         /* Ensure we have the correct type. */
 531         switch (prhdr->pkt_type) {
 532                 case RPC_ALTCONTRESP:
 533                 case RPC_BINDACK:
 534
 535                         /* Alter context and bind ack share the same packet definitions. */
 536                         break;
 537
 538
 539                 case RPC_RESPONSE:
 540                 {
 541                         RPC_HDR_RESP rhdr_resp;
 542                         uint8 ss_padding_len = 0;
 543
 544                         if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
 545                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
 546                                 return NT_STATUS_BUFFER_TOO_SMALL;
 547                         }
 548
 549                         /* Here's where we deal with incoming sign/seal. */
 550                         ret = cli_pipe_validate_rpc_response(cli, prhdr,
 551                                         current_pdu, &ss_padding_len);
 552                         if (!NT_STATUS_IS_OK(ret)) {
 553                                 return ret;
 554                         }
 555
 556                         /* Point the return values at the NDR data. Remember to remove any ss padding. */
 557                         *ppdata = prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
 558
 559                         if (current_pdu_len < RPC_HEADER_LEN + RPC_HDR_RESP_LEN + ss_padding_len) {
 560                                 return NT_STATUS_BUFFER_TOO_SMALL;
 561                         }
 562
 563                         *pdata_len = current_pdu_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - ss_padding_len;
 564
 565                         /* Remember to remove the auth footer. */
 566                         if (prhdr->auth_len) {
 567                                 /* We've already done integer wrap tests on auth_len in
 568                                         cli_pipe_validate_rpc_response(). */
 569                                 if (*pdata_len < RPC_HDR_AUTH_LEN + prhdr->auth_len) {
 570                                         return NT_STATUS_BUFFER_TOO_SMALL;
 571                                 }
 572                                 *pdata_len -= (RPC_HDR_AUTH_LEN + prhdr->auth_len);
 573                         }
 574
 575                         DEBUG(10,("cli_pipe_validate_current_pdu: got pdu len %u, data_len %u, ss_len %u\n",
 576                                 current_pdu_len, *pdata_len, ss_padding_len ));
 577
 578                         /*
 579                          * If this is the first reply, and the allocation hint is reasonably, try and
 580                          * set up the return_data parse_struct to the correct size.
 581                          */
 582
 583                         if ((prs_data_size(return_data) == 0) && rhdr_resp.alloc_hint && (rhdr_resp.alloc_hint < 15*1024*1024)) {
 584                                 if (!prs_set_buffer_size(return_data, rhdr_resp.alloc_hint)) {
 585                                         DEBUG(0,("cli_pipe_validate_current_pdu: reply alloc hint %u "
 586                                                 "too large to allocate\n",
 587                                                 (unsigned int)rhdr_resp.alloc_hint ));
 588                                         return NT_STATUS_NO_MEMORY;
 589                                 }
 590                         }
 591
 592                         break;
 593                 }
 594
 595                 case RPC_BINDNACK:
 596                         DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK received from remote machine %s "
 597                                 "pipe %s fnum 0x%x!\n",
 598                                 cli->desthost,
 599                                 cli->pipe_name,
 600                                 (unsigned int)cli->fnum));
 601                         /* Use this for now... */
 602                         return NT_STATUS_NETWORK_ACCESS_DENIED;
 603
 604                 case RPC_FAULT:
 605                 {
 606                         RPC_HDR_RESP rhdr_resp;
 607                         RPC_HDR_FAULT fault_resp;
 608
 609                         if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
 610                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
 611                                 return NT_STATUS_BUFFER_TOO_SMALL;
 612                         }
 613
 614                         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, current_pdu, 0)) {
 615                                 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_FAULT.\n"));
 616                                 return NT_STATUS_BUFFER_TOO_SMALL;
 617                         }
 618
 619                         DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault code %s received from remote machine %s "
 620                                 "pipe %s fnum 0x%x!\n",
 621                                 dcerpc_errstr(NT_STATUS_V(fault_resp.status)),
 622                                 cli->desthost,
 623                                 cli->pipe_name,
 624                                 (unsigned int)cli->fnum));
 625                         if (NT_STATUS_IS_OK(fault_resp.status)) {
 626                                 return NT_STATUS_UNSUCCESSFUL;
 627                         } else {
 628                                 return fault_resp.status;
 629                         }
 630
 631                 }
 632
 633                 default:
 634                         DEBUG(0, ("cli_pipe_validate_current_pdu: unknown packet type %u received "
 635                                 "from remote machine %s pipe %s fnum 0x%x!\n",
 636                                 (unsigned int)prhdr->pkt_type,
 637                                 cli->desthost,
 638                                 cli->pipe_name,
 639                                 (unsigned int)cli->fnum));
 640                         return NT_STATUS_INVALID_INFO_CLASS;
 641         }
 642
 643         if (prhdr->pkt_type != expected_pkt_type) {
 644                 DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to remote machine %s "
 645                         "pipe %s fnum %x got an unexpected RPC packet "
 646                         "type - %u, not %u\n",
 647                         cli->desthost,
 648                         cli->pipe_name,
 649                         (unsigned int)cli->fnum,
 650                         prhdr->pkt_type,
 651                         expected_pkt_type));
 652                 return NT_STATUS_INVALID_INFO_CLASS;
 653         }
 654
 655         /* Do this just before return - we don't want to modify any rpc header
 656            data before now as we may have needed to do cryptographic actions on
 657            it before. */
 658
 659         if ((prhdr->pkt_type == RPC_BINDACK) && !(prhdr->flags & RPC_FLG_LAST)) {
 660                 DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
 661                         "setting fragment first/last ON.\n"));
 662                 prhdr->flags |= RPC_FLG_FIRST|RPC_FLG_LAST;
 663         }
 664
 665         return NT_STATUS_OK;
 666 }
 667
 668 /****************************************************************************
 669  Ensure we eat the just processed pdu from the current_pdu prs_struct.
 670  Normally the frag_len and buffer size will match, but on the first trans
 671  reply there is a theoretical chance that buffer size > frag_len, so we must
 672  deal with that.
 673  ****************************************************************************/
 674
 675 static NTSTATUS cli_pipe_reset_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr, prs_struct *current_pdu)
 676 {
 677         uint32 current_pdu_len = prs_data_size(current_pdu);
 678
 679         if (current_pdu_len < prhdr->frag_len) {
 680                 return NT_STATUS_BUFFER_TOO_SMALL;
 681         }
 682
 683         /* Common case. */
 684         if (current_pdu_len == (uint32)prhdr->frag_len) {
 685                 prs_mem_free(current_pdu);
 686                 prs_init_empty(current_pdu, prs_get_mem_context(current_pdu), UNMARSHALL);
 687                 /* Make current_pdu dynamic with no memory. */
 688                 prs_give_memory(current_pdu, 0, 0, True);
 689                 return NT_STATUS_OK;
 690         }
 691
 692         /*
 693          * Oh no ! More data in buffer than we processed in current pdu.
 694          * Cheat. Move the data down and shrink the buffer.
 695          */
 696
 697         memcpy(prs_data_p(current_pdu), prs_data_p(current_pdu) + prhdr->frag_len,
 698                         current_pdu_len - prhdr->frag_len);
 699
 700         /* Remember to set the read offset back to zero. */
 701         prs_set_offset(current_pdu, 0);
 702
 703         /* Shrink the buffer. */
 704         if (!prs_set_buffer_size(current_pdu, current_pdu_len - prhdr->frag_len)) {
 705                 return NT_STATUS_BUFFER_TOO_SMALL;
 706         }
 707
 708         return NT_STATUS_OK;
 709 }
 710
 711 /****************************************************************************
 712  Send data on an rpc pipe via trans. The prs_struct data must be the last
 713  pdu fragment of an NDR data stream.
 714
 715  Receive response data from an rpc pipe, which may be large...
 716
 717  Read the first fragment: unfortunately have to use SMBtrans for the first
 718  bit, then SMBreadX for subsequent bits.
 719
 720  If first fragment received also wasn't the last fragment, continue
 721  getting fragments until we _do_ receive the last fragment.
 722
 723  Request/Response PDU's look like the following...
 724
 725  |<------------------PDU len----------------------------------------------->|
 726  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 727
 728  +------------+-----------------+-------------+---------------+-------------+
 729  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 730  +------------+-----------------+-------------+---------------+-------------+
 731
 732  Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
 733  signing & sealing being negotiated.
 734
 735  ****************************************************************************/
 736
 737 static NTSTATUS rpc_api_pipe(struct rpc_pipe_client *cli,
 738                         prs_struct *data, /* Outgoing pdu fragment, already formatted for send. */
 739                         prs_struct *rbuf, /* Incoming reply - return as an NDR stream. */
 740                         uint8 expected_pkt_type)
 741 {
 742         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 743         char *rparam = NULL;
 744         uint32 rparam_len = 0;
 745         uint16 setup[2];
 746         char *pdata = prs_data_p(data);
 747         uint32 data_len = prs_offset(data);
 748         char *prdata = NULL;
 749         uint32 rdata_len = 0;
 750         uint32 max_data = cli->max_xmit_frag ? cli->max_xmit_frag : RPC_MAX_PDU_FRAG_LEN;
 751         uint32 current_rbuf_offset = 0;
 752         prs_struct current_pdu;
 753
 754 #ifdef DEVELOPER
 755         /* Ensure we're not sending too much. */
 756         SMB_ASSERT(data_len <= max_data);
 757 #endif
 758
 759         /* Set up the current pdu parse struct. */
 760         prs_init_empty(&current_pdu, prs_get_mem_context(rbuf), UNMARSHALL);
 761
 762         /* Create setup parameters - must be in native byte order. */
 763         setup[0] = TRANSACT_DCERPCCMD;
 764         setup[1] = cli->fnum; /* Pipe file handle. */
 765
 766         DEBUG(5,("rpc_api_pipe: Remote machine %s pipe %s fnum 0x%x\n",
 767                 cli->desthost,
 768                 cli->pipe_name,
 769                 (unsigned int)cli->fnum ));
 770
 771         /*
 772          * Send the last (or only) fragment of an RPC request. For small
 773          * amounts of data (about 1024 bytes or so) the RPC request and response
 774          * appears in a SMBtrans request and response.
 775          */
 776
 777         if (!cli_api_pipe(cli->cli, "\\PIPE\\",
 778                   setup, 2, 0,                     /* Setup, length, max */
 779                   NULL, 0, 0,                      /* Params, length, max */
 780                   pdata, data_len, max_data,       /* data, length, max */
 781                   &rparam, &rparam_len,            /* return params, len */
 782                   &prdata, &rdata_len))            /* return data, len */
 783         {
 784                 DEBUG(0, ("rpc_api_pipe: Remote machine %s pipe %s fnum 0x%x "
 785                         "returned critical error. Error was %s\n",
 786                         cli->desthost,
 787                         cli->pipe_name,
 788                         (unsigned int)cli->fnum,
 789                         cli_errstr(cli->cli)));
 790                 ret = cli_get_nt_error(cli->cli);
 791                 SAFE_FREE(rparam);
 792                 SAFE_FREE(prdata);
 793                 goto err;
 794         }
 795
 796         /* Throw away returned params - we know we won't use them. */
 797
 798         SAFE_FREE(rparam);
 799
 800         if (prdata == NULL) {
 801                 DEBUG(3,("rpc_api_pipe: Remote machine %s pipe %s "
 802                         "fnum 0x%x failed to return data.\n",
 803                         cli->desthost,
 804                         cli->pipe_name,
 805                         (unsigned int)cli->fnum));
 806                 /* Yes - some calls can truely return no data... */
 807                 prs_mem_free(&current_pdu);
 808                 return NT_STATUS_OK;
 809         }
 810
 811         /*
 812          * Give this memory as dynamic to the current pdu.
 813          */
 814
 815         prs_give_memory(&current_pdu, prdata, rdata_len, True);
 816
 817         /* Ensure we can mess with the return prs_struct. */
 818         SMB_ASSERT(UNMARSHALLING(rbuf));
 819         SMB_ASSERT(prs_data_size(rbuf) == 0);
 820
 821         /* Make rbuf dynamic with no memory. */
 822         prs_give_memory(rbuf, 0, 0, True);
 823
 824         while(1) {
 825                 RPC_HDR rhdr;
 826                 char *ret_data;
 827                 uint32 ret_data_len;
 828
 829                 /* Ensure we have enough data for a pdu. */
 830                 ret = cli_pipe_get_current_pdu(cli, &rhdr, &current_pdu);
 831                 if (!NT_STATUS_IS_OK(ret)) {
 832                         goto err;
 833                 }
 834
 835                 /* We pass in rbuf here so if the alloc hint is set correctly
 836                    we can set the output size and avoid reallocs. */
 837
 838                 ret = cli_pipe_validate_current_pdu(cli, &rhdr, &current_pdu, expected_pkt_type,
 839                                 &ret_data, &ret_data_len, rbuf);
 840
 841                 DEBUG(10,("rpc_api_pipe: got PDU len of %u at offset %u\n",
 842                         prs_data_size(&current_pdu), current_rbuf_offset ));
 843
 844                 if (!NT_STATUS_IS_OK(ret)) {
 845                         goto err;
 846                 }
 847
 848                 if ((rhdr.flags & RPC_FLG_FIRST)) {
 849                         if (rhdr.pack_type[0] == 0) {
 850                                 /* Set the data type correctly for big-endian data on the first packet. */
 851                                 DEBUG(10,("rpc_api_pipe: On machine %s pipe %s fnum 0x%x "
 852                                         "PDU data format is big-endian.\n",
 853                                         cli->desthost,
 854                                         cli->pipe_name,
 855                                         (unsigned int)cli->fnum));
 856
 857                                 prs_set_endian_data(rbuf, RPC_BIG_ENDIAN);
 858                         } else {
 859                                 /* Check endianness on subsequent packets. */
 860                                 if (current_pdu.bigendian_data != rbuf->bigendian_data) {
 861                                         DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to %s\n",
 862                                                 rbuf->bigendian_data ? "big" : "little",
 863                                                 current_pdu.bigendian_data ? "big" : "little" ));
 864                                         ret = NT_STATUS_INVALID_PARAMETER;
 865                                         goto err;
 866                                 }
 867                         }
 868                 }
 869
 870                 /* Now copy the data portion out of the pdu into rbuf. */
 871                 if (!prs_force_grow(rbuf, ret_data_len)) {
 872                         ret = NT_STATUS_NO_MEMORY;
 873                         goto err;
 874                 }
 875                 memcpy(prs_data_p(rbuf)+current_rbuf_offset, ret_data, (size_t)ret_data_len);
 876                 current_rbuf_offset += ret_data_len;
 877
 878                 /* See if we've finished with all the data in current_pdu yet ? */
 879                 ret = cli_pipe_reset_current_pdu(cli, &rhdr, &current_pdu);
 880                 if (!NT_STATUS_IS_OK(ret)) {
 881                         goto err;
 882                 }
 883
 884                 if (rhdr.flags & RPC_FLG_LAST) {
 885                         break; /* We're done. */
 886                 }
 887         }
 888
 889         DEBUG(10,("rpc_api_pipe: Remote machine %s pipe %s fnum 0x%x returned %u bytes.\n",
 890                 cli->desthost,
 891                 cli->pipe_name,
 892                 (unsigned int)cli->fnum,
 893                 (unsigned int)prs_data_size(rbuf) ));
 894
 895         prs_mem_free(&current_pdu);
 896         return NT_STATUS_OK;
 897
 898   err:
 899
 900         prs_mem_free(&current_pdu);
 901         prs_mem_free(rbuf);
 902         return ret;
 903 }
 904
 905 /*******************************************************************
 906  Creates krb5 auth bind.
 907  ********************************************************************/
 908
 909 static NTSTATUS create_krb5_auth_bind_req( struct rpc_pipe_client *cli,
 910                                                 enum pipe_auth_level auth_level,
 911                                                 RPC_HDR_AUTH *pauth_out,
 912                                                 prs_struct *auth_data)
 913 {
 914 #ifdef HAVE_KRB5
 915         int ret;
 916         struct kerberos_auth_struct *a = cli->auth.a_u.kerberos_auth;
 917         DATA_BLOB tkt = data_blob_null;
 918         DATA_BLOB tkt_wrapped = data_blob_null;
 919
 920         /* We may change the pad length before marshalling. */
 921         init_rpc_hdr_auth(pauth_out, RPC_KRB5_AUTH_TYPE, (int)auth_level, 0, 1);
 922
 923         DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
 924                 a->service_principal ));
 925
 926         /* Create the ticket for the service principal and return it in a gss-api wrapped blob. */
 927
 928         ret = cli_krb5_get_ticket(a->service_principal, 0, &tkt,
 929                         &a->session_key, (uint32)AP_OPTS_MUTUAL_REQUIRED, NULL, NULL);
 930
 931         if (ret) {
 932                 DEBUG(1,("create_krb5_auth_bind_req: cli_krb5_get_ticket for principal %s "
 933                         "failed with %s\n",
 934                         a->service_principal,
 935                         error_message(ret) ));
 936
 937                 data_blob_free(&tkt);
 938                 prs_mem_free(auth_data);
 939                 return NT_STATUS_INVALID_PARAMETER;
 940         }
 941
 942         /* wrap that up in a nice GSS-API wrapping */
 943         tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
 944
 945         data_blob_free(&tkt);
 946
 947         /* Auth len in the rpc header doesn't include auth_header. */
 948         if (!prs_copy_data_in(auth_data, (char *)tkt_wrapped.data, tkt_wrapped.length)) {
 949                 data_blob_free(&tkt_wrapped);
 950                 prs_mem_free(auth_data);
 951                 return NT_STATUS_NO_MEMORY;
 952         }
 953
 954         DEBUG(5, ("create_krb5_auth_bind_req: Created krb5 GSS blob :\n"));
 955         dump_data(5, tkt_wrapped.data, tkt_wrapped.length);
 956
 957         data_blob_free(&tkt_wrapped);
 958         return NT_STATUS_OK;
 959 #else
 960         return NT_STATUS_INVALID_PARAMETER;
 961 #endif
 962 }
 963
 964 /*******************************************************************
 965  Creates SPNEGO NTLMSSP auth bind.
 966  ********************************************************************/
 967
 968 static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
 969                                                 enum pipe_auth_level auth_level,
 970                                                 RPC_HDR_AUTH *pauth_out,
 971                                                 prs_struct *auth_data)
 972 {
 973         NTSTATUS nt_status;
 974         DATA_BLOB null_blob = data_blob_null;
 975         DATA_BLOB request = data_blob_null;
 976         DATA_BLOB spnego_msg = data_blob_null;
 977
 978         /* We may change the pad length before marshalling. */
 979         init_rpc_hdr_auth(pauth_out, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
 980
 981         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
 982         nt_status = ntlmssp_update(cli->auth.a_u.ntlmssp_state,
 983                                         null_blob,
 984                                         &request);
 985
 986         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 987                 data_blob_free(&request);
 988                 prs_mem_free(auth_data);
 989                 return nt_status;
 990         }
 991
 992         /* Wrap this in SPNEGO. */
 993         spnego_msg = gen_negTokenInit(OID_NTLMSSP, request);
 994
 995         data_blob_free(&request);
 996
 997         /* Auth len in the rpc header doesn't include auth_header. */
 998         if (!prs_copy_data_in(auth_data, (char *)spnego_msg.data, spnego_msg.length)) {
 999                 data_blob_free(&spnego_msg);
1000                 prs_mem_free(auth_data);
1001                 return NT_STATUS_NO_MEMORY;
1002         }
1003
1004         DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1005         dump_data(5, spnego_msg.data, spnego_msg.length);
1006
1007         data_blob_free(&spnego_msg);
1008         return NT_STATUS_OK;
1009 }
1010
1011 /*******************************************************************
1012  Creates NTLMSSP auth bind.
1013  ********************************************************************/
1014
1015 static NTSTATUS create_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1016                                                 enum pipe_auth_level auth_level,
1017                                                 RPC_HDR_AUTH *pauth_out,
1018                                                 prs_struct *auth_data)
1019 {
1020         NTSTATUS nt_status;
1021         DATA_BLOB null_blob = data_blob_null;
1022         DATA_BLOB request = data_blob_null;
1023
1024         /* We may change the pad length before marshalling. */
1025         init_rpc_hdr_auth(pauth_out, RPC_NTLMSSP_AUTH_TYPE, (int)auth_level, 0, 1);
1026
1027         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1028         nt_status = ntlmssp_update(cli->auth.a_u.ntlmssp_state,
1029                                         null_blob,
1030                                         &request);
1031
1032         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1033                 data_blob_free(&request);
1034                 prs_mem_free(auth_data);
1035                 return nt_status;
1036         }
1037
1038         /* Auth len in the rpc header doesn't include auth_header. */
1039         if (!prs_copy_data_in(auth_data, (char *)request.data, request.length)) {
1040                 data_blob_free(&request);
1041                 prs_mem_free(auth_data);
1042                 return NT_STATUS_NO_MEMORY;
1043         }
1044
1045         DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1046         dump_data(5, request.data, request.length);
1047
1048         data_blob_free(&request);
1049         return NT_STATUS_OK;
1050 }
1051
1052 /*******************************************************************
1053  Creates schannel auth bind.
1054  ********************************************************************/
1055
1056 static NTSTATUS create_schannel_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1057                                                 enum pipe_auth_level auth_level,
1058                                                 RPC_HDR_AUTH *pauth_out,
1059                                                 prs_struct *auth_data)
1060 {
1061         RPC_AUTH_SCHANNEL_NEG schannel_neg;
1062
1063         /* We may change the pad length before marshalling. */
1064         init_rpc_hdr_auth(pauth_out, RPC_SCHANNEL_AUTH_TYPE, (int)auth_level, 0, 1);
1065
1066         /* Use lp_workgroup() if domain not specified */
1067
1068         if (!cli->domain || !cli->domain[0]) {
1069                 cli->domain = lp_workgroup();
1070         }
1071
1072         init_rpc_auth_schannel_neg(&schannel_neg, cli->domain, global_myname());
1073
1074         /*
1075          * Now marshall the data into the auth parse_struct.
1076          */
1077
1078         if(!smb_io_rpc_auth_schannel_neg("schannel_neg",
1079                                        &schannel_neg, auth_data, 0)) {
1080                 DEBUG(0,("Failed to marshall RPC_AUTH_SCHANNEL_NEG.\n"));
1081                 prs_mem_free(auth_data);
1082                 return NT_STATUS_NO_MEMORY;
1083         }
1084
1085         return NT_STATUS_OK;
1086 }
1087
1088 /*******************************************************************
1089  Creates the internals of a DCE/RPC bind request or alter context PDU.
1090  ********************************************************************/
1091
1092 static NTSTATUS create_bind_or_alt_ctx_internal(enum RPC_PKT_TYPE pkt_type,
1093                                                 prs_struct *rpc_out,
1094                                                 uint32 rpc_call_id,
1095                                                 RPC_IFACE *abstract,
1096                                                 RPC_IFACE *transfer,
1097                                                 RPC_HDR_AUTH *phdr_auth,
1098                                                 prs_struct *pauth_info)
1099 {
1100         RPC_HDR hdr;
1101         RPC_HDR_RB hdr_rb;
1102         RPC_CONTEXT rpc_ctx;
1103         uint16 auth_len = prs_offset(pauth_info);
1104         uint8 ss_padding_len = 0;
1105         uint16 frag_len = 0;
1106
1107         /* create the RPC context. */
1108         init_rpc_context(&rpc_ctx, 0 /* context id */, abstract, transfer);
1109
1110         /* create the bind request RPC_HDR_RB */
1111         init_rpc_hdr_rb(&hdr_rb, RPC_MAX_PDU_FRAG_LEN, RPC_MAX_PDU_FRAG_LEN, 0x0, &rpc_ctx);
1112
1113         /* Start building the frag length. */
1114         frag_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1115
1116         /* Do we need to pad ? */
1117         if (auth_len) {
1118                 uint16 data_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1119                 if (data_len % 8) {
1120                         ss_padding_len = 8 - (data_len % 8);
1121                         phdr_auth->auth_pad_len = ss_padding_len;
1122                 }
1123                 frag_len += RPC_HDR_AUTH_LEN + auth_len + ss_padding_len;
1124         }
1125
1126         /* Create the request RPC_HDR */
1127         init_rpc_hdr(&hdr, pkt_type, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id, frag_len, auth_len);
1128
1129         /* Marshall the RPC header */
1130         if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
1131                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR.\n"));
1132                 return NT_STATUS_NO_MEMORY;
1133         }
1134
1135         /* Marshall the bind request data */
1136         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
1137                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1138                 return NT_STATUS_NO_MEMORY;
1139         }
1140
1141         /*
1142          * Grow the outgoing buffer to store any auth info.
1143          */
1144
1145         if(auth_len != 0) {
1146                 if (ss_padding_len) {
1147                         char pad[8];
1148                         memset(pad, '\0', 8);
1149                         if (!prs_copy_data_in(rpc_out, pad, ss_padding_len)) {
1150                                 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall padding.\n"));
1151                                 return NT_STATUS_NO_MEMORY;
1152                         }
1153                 }
1154
1155                 if(!smb_io_rpc_hdr_auth("hdr_auth", phdr_auth, rpc_out, 0)) {
1156                         DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_AUTH.\n"));
1157                         return NT_STATUS_NO_MEMORY;
1158                 }
1159
1160
1161                 if(!prs_append_prs_data( rpc_out, pauth_info)) {
1162                         DEBUG(0,("create_bind_or_alt_ctx_internal: failed to grow parse struct to add auth.\n"));
1163                         return NT_STATUS_NO_MEMORY;
1164                 }
1165         }
1166
1167         return NT_STATUS_OK;
1168 }
1169
1170 /*******************************************************************
1171  Creates a DCE/RPC bind request.
1172  ********************************************************************/
1173
1174 static NTSTATUS create_rpc_bind_req(struct rpc_pipe_client *cli,
1175                                 prs_struct *rpc_out,
1176                                 uint32 rpc_call_id,
1177                                 RPC_IFACE *abstract, RPC_IFACE *transfer,
1178                                 enum pipe_auth_type auth_type,
1179                                 enum pipe_auth_level auth_level)
1180 {
1181         RPC_HDR_AUTH hdr_auth;
1182         prs_struct auth_info;
1183         NTSTATUS ret = NT_STATUS_OK;
1184
1185         ZERO_STRUCT(hdr_auth);
1186         if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
1187                 return NT_STATUS_NO_MEMORY;
1188
1189         switch (auth_type) {
1190                 case PIPE_AUTH_TYPE_SCHANNEL:
1191                         ret = create_schannel_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1192                         if (!NT_STATUS_IS_OK(ret)) {
1193                                 prs_mem_free(&auth_info);
1194                                 return ret;
1195                         }
1196                         break;
1197
1198                 case PIPE_AUTH_TYPE_NTLMSSP:
1199                         ret = create_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1200                         if (!NT_STATUS_IS_OK(ret)) {
1201                                 prs_mem_free(&auth_info);
1202                                 return ret;
1203                         }
1204                         break;
1205
1206                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1207                         ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1208                         if (!NT_STATUS_IS_OK(ret)) {
1209                                 prs_mem_free(&auth_info);
1210                                 return ret;
1211                         }
1212                         break;
1213
1214                 case PIPE_AUTH_TYPE_KRB5:
1215                         ret = create_krb5_auth_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1216                         if (!NT_STATUS_IS_OK(ret)) {
1217                                 prs_mem_free(&auth_info);
1218                                 return ret;
1219                         }
1220                         break;
1221
1222                 case PIPE_AUTH_TYPE_NONE:
1223                         break;
1224
1225                 default:
1226                         /* "Can't" happen. */
1227                         return NT_STATUS_INVALID_INFO_CLASS;
1228         }
1229
1230         ret = create_bind_or_alt_ctx_internal(RPC_BIND,
1231                                                 rpc_out,
1232                                                 rpc_call_id,
1233                                                 abstract,
1234                                                 transfer,
1235                                                 &hdr_auth,
1236                                                 &auth_info);
1237
1238         prs_mem_free(&auth_info);
1239         return ret;
1240 }
1241
1242 /*******************************************************************
1243  Create and add the NTLMSSP sign/seal auth header and data.
1244  ********************************************************************/
1245
1246 static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
1247                                         RPC_HDR *phdr,
1248                                         uint32 ss_padding_len,
1249                                         prs_struct *outgoing_pdu)
1250 {
1251         RPC_HDR_AUTH auth_info;
1252         NTSTATUS status;
1253         DATA_BLOB auth_blob = data_blob_null;
1254         uint16 data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
1255
1256         if (!cli->auth.a_u.ntlmssp_state) {
1257                 return NT_STATUS_INVALID_PARAMETER;
1258         }
1259
1260         /* Init and marshall the auth header. */
1261         init_rpc_hdr_auth(&auth_info,
1262                         map_pipe_auth_type_to_rpc_auth_type(cli->auth.auth_type),
1263                         cli->auth.auth_level,
1264                         ss_padding_len,
1265                         1 /* context id. */);
1266
1267         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
1268                 DEBUG(0,("add_ntlmssp_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
1269                 data_blob_free(&auth_blob);
1270                 return NT_STATUS_NO_MEMORY;
1271         }
1272
1273         switch (cli->auth.auth_level) {
1274                 case PIPE_AUTH_LEVEL_PRIVACY:
1275                         /* Data portion is encrypted. */
1276                         status = ntlmssp_seal_packet(cli->auth.a_u.ntlmssp_state,
1277                                         (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1278                                         data_and_pad_len,
1279                                         (unsigned char *)prs_data_p(outgoing_pdu),
1280                                         (size_t)prs_offset(outgoing_pdu),
1281                                         &auth_blob);
1282                         if (!NT_STATUS_IS_OK(status)) {
1283                                 data_blob_free(&auth_blob);
1284                                 return status;
1285                         }
1286                         break;
1287
1288                 case PIPE_AUTH_LEVEL_INTEGRITY:
1289                         /* Data is signed. */
1290                         status = ntlmssp_sign_packet(cli->auth.a_u.ntlmssp_state,
1291                                         (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1292                                         data_and_pad_len,
1293                                         (unsigned char *)prs_data_p(outgoing_pdu),
1294                                         (size_t)prs_offset(outgoing_pdu),
1295                                         &auth_blob);
1296                         if (!NT_STATUS_IS_OK(status)) {
1297                                 data_blob_free(&auth_blob);
1298                                 return status;
1299                         }
1300                         break;
1301
1302                 default:
1303                         /* Can't happen. */
1304                         smb_panic("bad auth level");
1305                         /* Notreached. */
1306                         return NT_STATUS_INVALID_PARAMETER;
1307         }
1308
1309         /* Finally marshall the blob. */
1310
1311         if (!prs_copy_data_in(outgoing_pdu, (const char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
1312                 DEBUG(0,("add_ntlmssp_auth_footer: failed to add %u bytes auth blob.\n",
1313                         (unsigned int)NTLMSSP_SIG_SIZE));
1314                 data_blob_free(&auth_blob);
1315                 return NT_STATUS_NO_MEMORY;
1316         }
1317
1318         data_blob_free(&auth_blob);
1319         return NT_STATUS_OK;
1320 }
1321
1322 /*******************************************************************
1323  Create and add the schannel sign/seal auth header and data.
1324  ********************************************************************/
1325
1326 static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
1327                                         RPC_HDR *phdr,
1328                                         uint32 ss_padding_len,
1329                                         prs_struct *outgoing_pdu)
1330 {
1331         RPC_HDR_AUTH auth_info;
1332         RPC_AUTH_SCHANNEL_CHK verf;
1333         struct schannel_auth_struct *sas = cli->auth.a_u.schannel_auth;
1334         char *data_p = prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
1335         size_t data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
1336
1337         if (!sas) {
1338                 return NT_STATUS_INVALID_PARAMETER;
1339         }
1340
1341         /* Init and marshall the auth header. */
1342         init_rpc_hdr_auth(&auth_info,
1343                         map_pipe_auth_type_to_rpc_auth_type(cli->auth.auth_type),
1344                         cli->auth.auth_level,
1345                         ss_padding_len,
1346                         1 /* context id. */);
1347
1348         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
1349                 DEBUG(0,("add_schannel_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
1350                 return NT_STATUS_NO_MEMORY;
1351         }
1352
1353         switch (cli->auth.auth_level) {
1354                 case PIPE_AUTH_LEVEL_PRIVACY:
1355                 case PIPE_AUTH_LEVEL_INTEGRITY:
1356                         DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
1357                                 sas->seq_num));
1358
1359                         schannel_encode(sas,
1360                                         cli->auth.auth_level,
1361                                         SENDER_IS_INITIATOR,
1362                                         &verf,
1363                                         data_p,
1364                                         data_and_pad_len);
1365
1366                         sas->seq_num++;
1367                         break;
1368
1369                 default:
1370                         /* Can't happen. */
1371                         smb_panic("bad auth level");
1372                         /* Notreached. */
1373                         return NT_STATUS_INVALID_PARAMETER;
1374         }
1375
1376         /* Finally marshall the blob. */
1377         smb_io_rpc_auth_schannel_chk("",
1378                         RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
1379                         &verf,
1380                         outgoing_pdu,
1381                         0);
1382
1383         return NT_STATUS_OK;
1384 }
1385
1386 /*******************************************************************
1387  Calculate how much data we're going to send in this packet, also
1388  work out any sign/seal padding length.
1389  ********************************************************************/
1390
1391 static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
1392                                         uint32 data_left,
1393                                         uint16 *p_frag_len,
1394                                         uint16 *p_auth_len,
1395                                         uint32 *p_ss_padding)
1396 {
1397         uint32 data_space, data_len;
1398
1399         switch (cli->auth.auth_level) {
1400                 case PIPE_AUTH_LEVEL_NONE:
1401                 case PIPE_AUTH_LEVEL_CONNECT:
1402                         data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN;
1403                         data_len = MIN(data_space, data_left);
1404                         *p_ss_padding = 0;
1405                         *p_auth_len = 0;
1406                         *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + data_len;
1407                         return data_len;
1408
1409                 case PIPE_AUTH_LEVEL_INTEGRITY:
1410                 case PIPE_AUTH_LEVEL_PRIVACY:
1411                         /* Treat the same for all authenticated rpc requests. */
1412                         switch(cli->auth.auth_type) {
1413                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1414                                 case PIPE_AUTH_TYPE_NTLMSSP:
1415                                         *p_auth_len = NTLMSSP_SIG_SIZE;
1416                                         break;
1417                                 case PIPE_AUTH_TYPE_SCHANNEL:
1418                                         *p_auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
1419                                         break;
1420                                 default:
1421                                         smb_panic("bad auth type");
1422                                         break;
1423                         }
1424
1425                         data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1426                                                 RPC_HDR_AUTH_LEN - *p_auth_len;
1427
1428                         data_len = MIN(data_space, data_left);
1429                         if (data_len % 8) {
1430                                 *p_ss_padding = 8 - (data_len % 8);
1431                         }
1432                         *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN +                /* Normal headers. */
1433                                         data_len + *p_ss_padding +              /* data plus padding. */
1434                                         RPC_HDR_AUTH_LEN + *p_auth_len;         /* Auth header and auth data. */
1435                         return data_len;
1436
1437                 default:
1438                         smb_panic("bad auth level");
1439                         /* Notreached. */
1440                         return 0;
1441         }
1442 }
1443
1444 /*******************************************************************
1445  External interface.
1446  Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1447  Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1448  and deals with signing/sealing details.
1449  ********************************************************************/
1450
1451 NTSTATUS rpc_api_pipe_req(struct rpc_pipe_client *cli,
1452                         uint8 op_num,
1453                         prs_struct *in_data,
1454                         prs_struct *out_data)
1455 {
1456         NTSTATUS ret;
1457         uint32 data_left = prs_offset(in_data);
1458         uint32 alloc_hint = prs_offset(in_data);
1459         uint32 data_sent_thistime = 0;
1460         uint32 current_data_offset = 0;
1461         uint32 call_id = get_rpc_call_id();
1462         char pad[8];
1463         prs_struct outgoing_pdu;
1464
1465         memset(pad, '\0', 8);
1466
1467         if (cli->max_xmit_frag < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_MAX_SIGN_SIZE) {
1468                 /* Server is screwed up ! */
1469                 return NT_STATUS_INVALID_PARAMETER;
1470         }
1471
1472         if (!prs_init(&outgoing_pdu, cli->max_xmit_frag, prs_get_mem_context(in_data), MARSHALL))
1473                 return NT_STATUS_NO_MEMORY;
1474
1475         while (1) {
1476                 RPC_HDR hdr;
1477                 RPC_HDR_REQ hdr_req;
1478                 uint16 auth_len = 0;
1479                 uint16 frag_len = 0;
1480                 uint8 flags = 0;
1481                 uint32 ss_padding = 0;
1482
1483                 data_sent_thistime = calculate_data_len_tosend(cli, data_left,
1484                                                 &frag_len, &auth_len, &ss_padding);
1485
1486                 if (current_data_offset == 0) {
1487                         flags = RPC_FLG_FIRST;
1488                 }
1489
1490                 if (data_sent_thistime == data_left) {
1491                         flags |= RPC_FLG_LAST;
1492                 }
1493
1494                 /* Create and marshall the header and request header. */
1495                 init_rpc_hdr(&hdr, RPC_REQUEST, flags, call_id, frag_len, auth_len);
1496
1497                 if(!smb_io_rpc_hdr("hdr    ", &hdr, &outgoing_pdu, 0)) {
1498                         prs_mem_free(&outgoing_pdu);
1499                         return NT_STATUS_NO_MEMORY;
1500                 }
1501
1502                 /* Create the rpc request RPC_HDR_REQ */
1503                 init_rpc_hdr_req(&hdr_req, alloc_hint, op_num);
1504
1505                 if(!smb_io_rpc_hdr_req("hdr_req", &hdr_req, &outgoing_pdu, 0)) {
1506                         prs_mem_free(&outgoing_pdu);
1507                         return NT_STATUS_NO_MEMORY;
1508                 }
1509
1510                 /* Copy in the data, plus any ss padding. */
1511                 if (!prs_append_some_prs_data(&outgoing_pdu, in_data, current_data_offset, data_sent_thistime)) {
1512                         prs_mem_free(&outgoing_pdu);
1513                         return NT_STATUS_NO_MEMORY;
1514                 }
1515
1516                 /* Copy the sign/seal padding data. */
1517                 if (ss_padding) {
1518                         if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding)) {
1519                                 prs_mem_free(&outgoing_pdu);
1520                                 return NT_STATUS_NO_MEMORY;
1521                         }
1522                 }
1523
1524                 /* Generate any auth sign/seal and add the auth footer. */
1525                 if (auth_len) {
1526                         switch (cli->auth.auth_type) {
1527                                 case PIPE_AUTH_TYPE_NONE:
1528                                         break;
1529                                 case PIPE_AUTH_TYPE_NTLMSSP:
1530                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1531                                         ret = add_ntlmssp_auth_footer(cli, &hdr, ss_padding, &outgoing_pdu);
1532                                         if (!NT_STATUS_IS_OK(ret)) {
1533                                                 prs_mem_free(&outgoing_pdu);
1534                                                 return ret;
1535                                         }
1536                                         break;
1537                                 case PIPE_AUTH_TYPE_SCHANNEL:
1538                                         ret = add_schannel_auth_footer(cli, &hdr, ss_padding, &outgoing_pdu);
1539                                         if (!NT_STATUS_IS_OK(ret)) {
1540                                                 prs_mem_free(&outgoing_pdu);
1541                                                 return ret;
1542                                         }
1543                                         break;
1544                                 default:
1545                                         smb_panic("bad auth type");
1546                                         break; /* notreached */
1547                         }
1548                 }
1549
1550                 /* Actually send the packet. */
1551                 if (flags & RPC_FLG_LAST) {
1552                         /* Last packet - send the data, get the reply and return. */
1553                         ret = rpc_api_pipe(cli, &outgoing_pdu, out_data, RPC_RESPONSE);
1554                         prs_mem_free(&outgoing_pdu);
1555
1556                         if (DEBUGLEVEL >= 50) {
1557                                 char *dump_name = NULL;
1558                                 /* Also capture received data */
1559                                 if (asprintf(&dump_name, "%s/reply_%s_%d",
1560                                                 get_dyn_LOGFILEBASE(), cli->pipe_name,
1561                                                 op_num) > 0) {
1562                                         prs_dump(dump_name, op_num, out_data);
1563                                         SAFE_FREE(dump_name);
1564                                 }
1565                         }
1566
1567                         return ret;
1568                 } else {
1569                         /* More packets to come - write and continue. */
1570                         ssize_t num_written = cli_write(cli->cli, cli->fnum, 8, /* 8 means message mode. */
1571                                                         prs_data_p(&outgoing_pdu),
1572                                                         (off_t)0,
1573                                                         (size_t)hdr.frag_len);
1574
1575                         if (num_written != hdr.frag_len) {
1576                                 prs_mem_free(&outgoing_pdu);
1577                                 return cli_get_nt_error(cli->cli);
1578                         }
1579                 }
1580
1581                 current_data_offset += data_sent_thistime;
1582                 data_left -= data_sent_thistime;
1583
1584                 /* Reset the marshalling position back to zero. */
1585                 if (!prs_set_offset(&outgoing_pdu, 0)) {
1586                         prs_mem_free(&outgoing_pdu);
1587                         return NT_STATUS_NO_MEMORY;
1588                 }
1589         }
1590 }
1591 #if 0
1592 /****************************************************************************
1593  Set the handle state.
1594 ****************************************************************************/
1595
1596 static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
1597                                    const char *pipe_name, uint16 device_state)
1598 {
1599         bool state_set = False;
1600         char param[2];
1601         uint16 setup[2]; /* only need 2 uint16 setup parameters */
1602         char *rparam = NULL;
1603         char *rdata = NULL;
1604         uint32 rparam_len, rdata_len;
1605
1606         if (pipe_name == NULL)
1607                 return False;
1608
1609         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
1610                  cli->fnum, pipe_name, device_state));
1611
1612         /* create parameters: device state */
1613         SSVAL(param, 0, device_state);
1614
1615         /* create setup parameters. */
1616         setup[0] = 0x0001;
1617         setup[1] = cli->fnum; /* pipe file handle.  got this from an SMBOpenX. */
1618
1619         /* send the data on \PIPE\ */
1620         if (cli_api_pipe(cli->cli, "\\PIPE\\",
1621                     setup, 2, 0,                /* setup, length, max */
1622                     param, 2, 0,                /* param, length, max */
1623                     NULL, 0, 1024,              /* data, length, max */
1624                     &rparam, &rparam_len,        /* return param, length */
1625                     &rdata, &rdata_len))         /* return data, length */
1626         {
1627                 DEBUG(5, ("Set Handle state: return OK\n"));
1628                 state_set = True;
1629         }
1630
1631         SAFE_FREE(rparam);
1632         SAFE_FREE(rdata);
1633
1634         return state_set;
1635 }
1636 #endif
1637
1638 /****************************************************************************
1639  Check the rpc bind acknowledge response.
1640 ****************************************************************************/
1641
1642 static bool valid_pipe_name(const int pipe_idx, RPC_IFACE *abstract, RPC_IFACE *transfer)
1643 {
1644         if ( pipe_idx >= PI_MAX_PIPES ) {
1645                 DEBUG(0,("valid_pipe_name: Programmer error!  Invalid pipe index [%d]\n",
1646                         pipe_idx));
1647                 return False;
1648         }
1649
1650         DEBUG(5,("Bind Abstract Syntax: "));
1651         dump_data(5, (uint8 *)&pipe_names[pipe_idx].abstr_syntax,
1652                   sizeof(pipe_names[pipe_idx].abstr_syntax));
1653         DEBUG(5,("Bind Transfer Syntax: "));
1654         dump_data(5, (uint8 *)&pipe_names[pipe_idx].trans_syntax,
1655                   sizeof(pipe_names[pipe_idx].trans_syntax));
1656
1657         /* copy the required syntaxes out so we can do the right bind */
1658
1659         *transfer = *pipe_names[pipe_idx].trans_syntax;
1660         *abstract = *pipe_names[pipe_idx].abstr_syntax;
1661
1662         return True;
1663 }
1664
1665 /****************************************************************************
1666  Check the rpc bind acknowledge response.
1667 ****************************************************************************/
1668
1669 static bool check_bind_response(RPC_HDR_BA *hdr_ba, const int pipe_idx, RPC_IFACE *transfer)
1670 {
1671         if ( hdr_ba->addr.len == 0) {
1672                 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1673         }
1674
1675         /* check the transfer syntax */
1676         if ((hdr_ba->transfer.if_version != transfer->if_version) ||
1677              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1678                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1679                 return False;
1680         }
1681
1682         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
1683                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1684                           hdr_ba->res.num_results, hdr_ba->res.reason));
1685         }
1686
1687         DEBUG(5,("check_bind_response: accepted!\n"));
1688         return True;
1689 }
1690
1691 /*******************************************************************
1692  Creates a DCE/RPC bind authentication response.
1693  This is the packet that is sent back to the server once we
1694  have received a BIND-ACK, to finish the third leg of
1695  the authentication handshake.
1696  ********************************************************************/
1697
1698 static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
1699                                 uint32 rpc_call_id,
1700                                 enum pipe_auth_type auth_type,
1701                                 enum pipe_auth_level auth_level,
1702                                 DATA_BLOB *pauth_blob,
1703                                 prs_struct *rpc_out)
1704 {
1705         RPC_HDR hdr;
1706         RPC_HDR_AUTH hdr_auth;
1707         uint32 pad = 0;
1708
1709         /* Create the request RPC_HDR */
1710         init_rpc_hdr(&hdr, RPC_AUTH3, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id,
1711                      RPC_HEADER_LEN + 4 /* pad */ + RPC_HDR_AUTH_LEN + pauth_blob->length,
1712                      pauth_blob->length );
1713
1714         /* Marshall it. */
1715         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
1716                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR.\n"));
1717                 return NT_STATUS_NO_MEMORY;
1718         }
1719
1720         /*
1721                 I'm puzzled about this - seems to violate the DCE RPC auth rules,
1722                 about padding - shouldn't this pad to length 8 ? JRA.
1723         */
1724
1725         /* 4 bytes padding. */
1726         if (!prs_uint32("pad", rpc_out, 0, &pad)) {
1727                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall 4 byte pad.\n"));
1728                 return NT_STATUS_NO_MEMORY;
1729         }
1730
1731         /* Create the request RPC_HDR_AUTHA */
1732         init_rpc_hdr_auth(&hdr_auth,
1733                         map_pipe_auth_type_to_rpc_auth_type(auth_type),
1734                         auth_level, 0, 1);
1735
1736         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rpc_out, 0)) {
1737                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR_AUTHA.\n"));
1738                 return NT_STATUS_NO_MEMORY;
1739         }
1740
1741         /*
1742          * Append the auth data to the outgoing buffer.
1743          */
1744
1745         if(!prs_copy_data_in(rpc_out, (char *)pauth_blob->data, pauth_blob->length)) {
1746                 DEBUG(0,("create_rpc_bind_auth3: failed to marshall auth blob.\n"));
1747                 return NT_STATUS_NO_MEMORY;
1748         }
1749
1750         return NT_STATUS_OK;
1751 }
1752
1753 /****************************************************************************
1754  Create and send the third packet in an RPC auth.
1755 ****************************************************************************/
1756
1757 static NTSTATUS rpc_finish_auth3_bind(struct rpc_pipe_client *cli,
1758                                 RPC_HDR *phdr,
1759                                 prs_struct *rbuf,
1760                                 uint32 rpc_call_id,
1761                                 enum pipe_auth_type auth_type,
1762                                 enum pipe_auth_level auth_level)
1763 {
1764         DATA_BLOB server_response = data_blob_null;
1765         DATA_BLOB client_reply = data_blob_null;
1766         RPC_HDR_AUTH hdr_auth;
1767         NTSTATUS nt_status;
1768         prs_struct rpc_out;
1769         ssize_t ret;
1770
1771         if (!phdr->auth_len || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
1772                 return NT_STATUS_INVALID_PARAMETER;
1773         }
1774
1775         /* Process the returned NTLMSSP blob first. */
1776         if (!prs_set_offset(rbuf, phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
1777                 return NT_STATUS_INVALID_PARAMETER;
1778         }
1779
1780         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rbuf, 0)) {
1781                 return NT_STATUS_INVALID_PARAMETER;
1782         }
1783
1784         /* TODO - check auth_type/auth_level match. */
1785
1786         server_response = data_blob(NULL, phdr->auth_len);
1787         prs_copy_data_out((char *)server_response.data, rbuf, phdr->auth_len);
1788
1789         nt_status = ntlmssp_update(cli->auth.a_u.ntlmssp_state,
1790                                    server_response,
1791                                    &client_reply);
1792
1793         if (!NT_STATUS_IS_OK(nt_status)) {
1794                 DEBUG(0,("rpc_finish_auth3_bind: NTLMSSP update using server blob failed.\n"));
1795                 data_blob_free(&server_response);
1796                 return nt_status;
1797         }
1798
1799         prs_init_empty(&rpc_out, prs_get_mem_context(rbuf), MARSHALL);
1800
1801         nt_status = create_rpc_bind_auth3(cli, rpc_call_id,
1802                                 auth_type, auth_level,
1803                                 &client_reply, &rpc_out);
1804
1805         if (!NT_STATUS_IS_OK(nt_status)) {
1806                 prs_mem_free(&rpc_out);
1807                 data_blob_free(&client_reply);
1808                 data_blob_free(&server_response);
1809                 return nt_status;
1810         }
1811
1812         /* 8 here is named pipe message mode. */
1813         ret = cli_write(cli->cli, cli->fnum, 0x8, prs_data_p(&rpc_out), 0,
1814                                 (size_t)prs_offset(&rpc_out));
1815
1816         if (ret != (ssize_t)prs_offset(&rpc_out)) {
1817                 DEBUG(0,("rpc_send_auth_auth3: cli_write failed. Return was %d\n", (int)ret));
1818                 prs_mem_free(&rpc_out);
1819                 data_blob_free(&client_reply);
1820                 data_blob_free(&server_response);
1821                 return cli_get_nt_error(cli->cli);
1822         }
1823
1824         DEBUG(5,("rpc_send_auth_auth3: Remote machine %s pipe %s "
1825                 "fnum 0x%x sent auth3 response ok.\n",
1826                 cli->desthost,
1827                 cli->pipe_name,
1828                 (unsigned int)cli->fnum));
1829
1830         prs_mem_free(&rpc_out);
1831         data_blob_free(&client_reply);
1832         data_blob_free(&server_response);
1833         return NT_STATUS_OK;
1834 }
1835
1836 /*******************************************************************
1837  Creates a DCE/RPC bind alter context authentication request which
1838  may contain a spnego auth blobl
1839  ********************************************************************/
1840
1841 static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
1842                                         RPC_IFACE *abstract,
1843                                         RPC_IFACE *transfer,
1844                                         enum pipe_auth_level auth_level,
1845                                         const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1846                                         prs_struct *rpc_out)
1847 {
1848         RPC_HDR_AUTH hdr_auth;
1849         prs_struct auth_info;
1850         NTSTATUS ret = NT_STATUS_OK;
1851
1852         ZERO_STRUCT(hdr_auth);
1853         if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
1854                 return NT_STATUS_NO_MEMORY;
1855
1856         /* We may change the pad length before marshalling. */
1857         init_rpc_hdr_auth(&hdr_auth, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
1858
1859         if (pauth_blob->length) {
1860                 if (!prs_copy_data_in(&auth_info, (const char *)pauth_blob->data, pauth_blob->length)) {
1861                         prs_mem_free(&auth_info);
1862                         return NT_STATUS_NO_MEMORY;
1863                 }
1864         }
1865
1866         ret = create_bind_or_alt_ctx_internal(RPC_ALTCONT,
1867                                                 rpc_out,
1868                                                 rpc_call_id,
1869                                                 abstract,
1870                                                 transfer,
1871                                                 &hdr_auth,
1872                                                 &auth_info);
1873         prs_mem_free(&auth_info);
1874         return ret;
1875 }
1876
1877 /*******************************************************************
1878  Third leg of the SPNEGO bind mechanism - sends alter context PDU
1879  and gets a response.
1880  ********************************************************************/
1881
1882 static NTSTATUS rpc_finish_spnego_ntlmssp_bind(struct rpc_pipe_client *cli,
1883                                 RPC_HDR *phdr,
1884                                 prs_struct *rbuf,
1885                                 uint32 rpc_call_id,
1886                                 RPC_IFACE *abstract,
1887                                 RPC_IFACE *transfer,
1888                                 enum pipe_auth_type auth_type,
1889                                 enum pipe_auth_level auth_level)
1890 {
1891         DATA_BLOB server_spnego_response = data_blob_null;
1892         DATA_BLOB server_ntlm_response = data_blob_null;
1893         DATA_BLOB client_reply = data_blob_null;
1894         DATA_BLOB tmp_blob = data_blob_null;
1895         RPC_HDR_AUTH hdr_auth;
1896         NTSTATUS nt_status;
1897         prs_struct rpc_out;
1898
1899         if (!phdr->auth_len || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
1900                 return NT_STATUS_INVALID_PARAMETER;
1901         }
1902
1903         /* Process the returned NTLMSSP blob first. */
1904         if (!prs_set_offset(rbuf, phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
1905                 return NT_STATUS_INVALID_PARAMETER;
1906         }
1907
1908         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rbuf, 0)) {
1909                 return NT_STATUS_INVALID_PARAMETER;
1910         }
1911
1912         server_spnego_response = data_blob(NULL, phdr->auth_len);
1913         prs_copy_data_out((char *)server_spnego_response.data, rbuf, phdr->auth_len);
1914
1915         /* The server might give us back two challenges - tmp_blob is for the second. */
1916         if (!spnego_parse_challenge(server_spnego_response, &server_ntlm_response, &tmp_blob)) {
1917                 data_blob_free(&server_spnego_response);
1918                 data_blob_free(&server_ntlm_response);
1919                 data_blob_free(&tmp_blob);
1920                 return NT_STATUS_INVALID_PARAMETER;
1921         }
1922
1923         /* We're finished with the server spnego response and the tmp_blob. */
1924         data_blob_free(&server_spnego_response);
1925         data_blob_free(&tmp_blob);
1926
1927         nt_status = ntlmssp_update(cli->auth.a_u.ntlmssp_state,
1928                                    server_ntlm_response,
1929                                    &client_reply);
1930
1931         /* Finished with the server_ntlm response */
1932         data_blob_free(&server_ntlm_response);
1933
1934         if (!NT_STATUS_IS_OK(nt_status)) {
1935                 DEBUG(0,("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update using server blob failed.\n"));
1936                 data_blob_free(&client_reply);
1937                 return nt_status;
1938         }
1939
1940         /* SPNEGO wrap the client reply. */
1941         tmp_blob = spnego_gen_auth(client_reply);
1942         data_blob_free(&client_reply);
1943         client_reply = tmp_blob;
1944         tmp_blob = data_blob_null; /* Ensure it's safe to free this just in case. */
1945
1946         /* Now prepare the alter context pdu. */
1947         prs_init_empty(&rpc_out, prs_get_mem_context(rbuf), MARSHALL);
1948
1949         nt_status = create_rpc_alter_context(rpc_call_id,
1950                                                 abstract,
1951                                                 transfer,
1952                                                 auth_level,
1953                                                 &client_reply,
1954                                                 &rpc_out);
1955
1956         data_blob_free(&client_reply);
1957
1958         if (!NT_STATUS_IS_OK(nt_status)) {
1959                 prs_mem_free(&rpc_out);
1960                 return nt_status;
1961         }
1962
1963         /* Initialize the returning data struct. */
1964         prs_mem_free(rbuf);
1965         prs_init_empty(rbuf, talloc_tos(), UNMARSHALL);
1966
1967         nt_status = rpc_api_pipe(cli, &rpc_out, rbuf, RPC_ALTCONTRESP);
1968         if (!NT_STATUS_IS_OK(nt_status)) {
1969                 prs_mem_free(&rpc_out);
1970                 return nt_status;
1971         }
1972
1973         prs_mem_free(&rpc_out);
1974
1975         /* Get the auth blob from the reply. */
1976         if(!smb_io_rpc_hdr("rpc_hdr   ", phdr, rbuf, 0)) {
1977                 DEBUG(0,("rpc_finish_spnego_ntlmssp_bind: Failed to unmarshall RPC_HDR.\n"));
1978                 return NT_STATUS_BUFFER_TOO_SMALL;
1979         }
1980
1981         if (!prs_set_offset(rbuf, phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
1982                 return NT_STATUS_INVALID_PARAMETER;
1983         }
1984
1985         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rbuf, 0)) {
1986                 return NT_STATUS_INVALID_PARAMETER;
1987         }
1988
1989         server_spnego_response = data_blob(NULL, phdr->auth_len);
1990         prs_copy_data_out((char *)server_spnego_response.data, rbuf, phdr->auth_len);
1991
1992         /* Check we got a valid auth response. */
1993         if (!spnego_parse_auth_response(server_spnego_response, NT_STATUS_OK, OID_NTLMSSP, &tmp_blob)) {
1994                 data_blob_free(&server_spnego_response);
1995                 data_blob_free(&tmp_blob);
1996                 return NT_STATUS_INVALID_PARAMETER;
1997         }
1998
1999         data_blob_free(&server_spnego_response);
2000         data_blob_free(&tmp_blob);
2001
2002         DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
2003                 "remote machine %s pipe %s fnum 0x%x.\n",
2004                 cli->desthost,
2005                 cli->pipe_name,
2006                 (unsigned int)cli->fnum));
2007
2008         return NT_STATUS_OK;
2009 }
2010
2011 /****************************************************************************
2012  Do an rpc bind.
2013 ****************************************************************************/
2014
2015 static NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
2016                         enum pipe_auth_type auth_type,
2017                         enum pipe_auth_level auth_level)
2018 {
2019         RPC_HDR hdr;
2020         RPC_HDR_BA hdr_ba;
2021         RPC_IFACE abstract;
2022         RPC_IFACE transfer;
2023         prs_struct rpc_out;
2024         prs_struct rbuf;
2025         uint32 rpc_call_id;
2026         NTSTATUS status;
2027
2028         DEBUG(5,("Bind RPC Pipe[%x]: %s auth_type %u, auth_level %u\n",
2029                 (unsigned int)cli->fnum,
2030                 cli->pipe_name,
2031                 (unsigned int)auth_type,
2032                 (unsigned int)auth_level ));
2033
2034         if (!valid_pipe_name(cli->pipe_idx, &abstract, &transfer)) {
2035                 return NT_STATUS_INVALID_PARAMETER;
2036         }
2037
2038         prs_init_empty(&rpc_out, talloc_tos(), MARSHALL);
2039
2040         rpc_call_id = get_rpc_call_id();
2041
2042         /* Marshall the outgoing data. */
2043         status = create_rpc_bind_req(cli, &rpc_out, rpc_call_id,
2044                                 &abstract, &transfer,
2045                                 auth_type,
2046                                 auth_level);
2047
2048         if (!NT_STATUS_IS_OK(status)) {
2049                 prs_mem_free(&rpc_out);
2050                 return status;
2051         }
2052
2053         /* Initialize the incoming data struct. */
2054         prs_init_empty(&rbuf, talloc_tos(), UNMARSHALL);
2055
2056         /* send data on \PIPE\.  receive a response */
2057         status = rpc_api_pipe(cli, &rpc_out, &rbuf, RPC_BINDACK);
2058         if (!NT_STATUS_IS_OK(status)) {
2059                 prs_mem_free(&rpc_out);
2060                 return status;
2061         }
2062
2063         prs_mem_free(&rpc_out);
2064
2065         DEBUG(3,("rpc_pipe_bind: Remote machine %s pipe %s "
2066                 "fnum 0x%x bind request returned ok.\n",
2067                 cli->desthost,
2068                 cli->pipe_name,
2069                 (unsigned int)cli->fnum));
2070
2071         /* Unmarshall the RPC header */
2072         if(!smb_io_rpc_hdr("hdr"   , &hdr, &rbuf, 0)) {
2073                 DEBUG(0,("rpc_pipe_bind: failed to unmarshall RPC_HDR.\n"));
2074                 prs_mem_free(&rbuf);
2075                 return NT_STATUS_BUFFER_TOO_SMALL;
2076         }
2077
2078         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &rbuf, 0)) {
2079                 DEBUG(0,("rpc_pipe_bind: Failed to unmarshall RPC_HDR_BA.\n"));
2080                 prs_mem_free(&rbuf);
2081                 return NT_STATUS_BUFFER_TOO_SMALL;
2082         }
2083
2084         if(!check_bind_response(&hdr_ba, cli->pipe_idx, &transfer)) {
2085                 DEBUG(2,("rpc_pipe_bind: check_bind_response failed.\n"));
2086                 prs_mem_free(&rbuf);
2087                 return NT_STATUS_BUFFER_TOO_SMALL;
2088         }
2089
2090         cli->max_xmit_frag = hdr_ba.bba.max_tsize;
2091         cli->max_recv_frag = hdr_ba.bba.max_rsize;
2092
2093         /* For authenticated binds we may need to do 3 or 4 leg binds. */
2094         switch(auth_type) {
2095
2096                 case PIPE_AUTH_TYPE_NONE:
2097                 case PIPE_AUTH_TYPE_SCHANNEL:
2098                         /* Bind complete. */
2099                         break;
2100
2101                 case PIPE_AUTH_TYPE_NTLMSSP:
2102                         /* Need to send AUTH3 packet - no reply. */
2103                         status = rpc_finish_auth3_bind(cli, &hdr, &rbuf, rpc_call_id,
2104                                                 auth_type, auth_level);
2105                         if (!NT_STATUS_IS_OK(status)) {
2106                                 prs_mem_free(&rbuf);
2107                                 return status;
2108                         }
2109                         break;
2110
2111                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2112                         /* Need to send alter context request and reply. */
2113                         status = rpc_finish_spnego_ntlmssp_bind(cli, &hdr, &rbuf, rpc_call_id,
2114                                                 &abstract, &transfer,
2115                                                 auth_type, auth_level);
2116                         if (!NT_STATUS_IS_OK(status)) {
2117                                 prs_mem_free(&rbuf);
2118                                 return status;
2119                         }
2120                         break;
2121
2122                 case PIPE_AUTH_TYPE_KRB5:
2123                         /* */
2124
2125                 default:
2126                         DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
2127                                 (unsigned int)auth_type ));
2128                         prs_mem_free(&rbuf);
2129                         return NT_STATUS_INVALID_INFO_CLASS;
2130         }
2131
2132         /* For NTLMSSP ensure the server gave us the auth_level we wanted. */
2133         if (auth_type == PIPE_AUTH_TYPE_NTLMSSP || auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
2134                 if (auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
2135                         if (!(cli->auth.a_u.ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
2136                                 DEBUG(0,("cli_finish_bind_auth: requested NTLMSSSP signing and server refused.\n"));
2137                                 prs_mem_free(&rbuf);
2138                                 return NT_STATUS_INVALID_PARAMETER;
2139                         }
2140                 }
2141                 if (auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
2142                         if (!(cli->auth.a_u.ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
2143                                 DEBUG(0,("cli_finish_bind_auth: requested NTLMSSSP sealing and server refused.\n"));
2144                                 prs_mem_free(&rbuf);
2145                                 return NT_STATUS_INVALID_PARAMETER;
2146                         }
2147                 }
2148         }
2149
2150         /* Pipe is bound - set up auth_type and auth_level data. */
2151
2152         cli->auth.auth_type = auth_type;
2153         cli->auth.auth_level = auth_level;
2154
2155         prs_mem_free(&rbuf);
2156         return NT_STATUS_OK;
2157 }
2158
2159 unsigned int rpccli_set_timeout(struct rpc_pipe_client *cli,
2160                                 unsigned int timeout)
2161 {
2162         return cli_set_timeout(cli->cli, timeout);
2163 }
2164
2165 /****************************************************************************
2166  Open a named pipe over SMB to a remote server.
2167  *
2168  * CAVEAT CALLER OF THIS FUNCTION:
2169  *    The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2170  *    so be sure that this function is called AFTER any structure (vs pointer)
2171  *    assignment of the cli.  In particular, libsmbclient does structure
2172  *    assignments of cli, which invalidates the data in the returned
2173  *    rpc_pipe_client if this function is called before the structure assignment
2174  *    of cli.
2175  *
2176  ****************************************************************************/
2177
2178 static struct rpc_pipe_client *cli_rpc_pipe_open(struct cli_state *cli, int pipe_idx, NTSTATUS *perr)
2179 {
2180         struct rpc_pipe_client *result;
2181         int fnum;
2182
2183         *perr = NT_STATUS_NO_MEMORY;
2184
2185         /* sanity check to protect against crashes */
2186
2187         if ( !cli ) {
2188                 *perr = NT_STATUS_INVALID_HANDLE;
2189                 return NULL;
2190         }
2191
2192         /* The pipe name index must fall within our array */
2193         SMB_ASSERT((pipe_idx >= 0) && (pipe_idx < PI_MAX_PIPES));
2194
2195         result = TALLOC_ZERO_P(NULL, struct rpc_pipe_client);
2196         if (result == NULL) {
2197                 return NULL;
2198         }
2199
2200         result->pipe_name = cli_get_pipe_name(pipe_idx);
2201
2202         fnum = cli_nt_create(cli, result->pipe_name, DESIRED_ACCESS_PIPE);
2203
2204         if (fnum == -1) {
2205                 DEBUG(1,("cli_rpc_pipe_open: cli_nt_create failed on pipe %s "
2206                          "to machine %s.  Error was %s\n",
2207                          result->pipe_name, cli->desthost,
2208                          cli_errstr(cli)));
2209                 *perr = cli_get_nt_error(cli);
2210                 talloc_destroy(result);
2211                 return NULL;
2212         }
2213
2214         result->fnum = fnum;
2215         result->cli = cli;
2216         result->pipe_idx = pipe_idx;
2217         result->auth.auth_type = PIPE_AUTH_TYPE_NONE;
2218         result->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
2219
2220         result->desthost = talloc_strdup(result, cli->desthost);
2221         if (result->desthost == NULL) {
2222                 TALLOC_FREE(result);
2223                 return NULL;
2224         }
2225
2226         result->srv_name_slash = talloc_asprintf_strupper_m(
2227                 result, "\\\\%s", result->desthost);
2228         if (result->srv_name_slash == NULL) {
2229                 TALLOC_FREE(result);
2230                 return NULL;
2231         }
2232
2233         if (pipe_idx == PI_NETLOGON) {
2234                 /* Set up a netlogon credential chain for a netlogon pipe. */
2235                 result->dc = TALLOC_ZERO_P(result, struct dcinfo);
2236                 if (result->dc == NULL) {
2237                         talloc_destroy(result);
2238                         return NULL;
2239                 }
2240         }
2241
2242         DLIST_ADD(cli->pipe_list, result);
2243         *perr = NT_STATUS_OK;
2244
2245         return result;
2246 }
2247
2248 /****************************************************************************
2249  Open a named pipe to an SMB server and bind anonymously.
2250  ****************************************************************************/
2251
2252 struct rpc_pipe_client *cli_rpc_pipe_open_noauth(struct cli_state *cli, int pipe_idx, NTSTATUS *perr)
2253 {
2254         struct rpc_pipe_client *result;
2255
2256         result = cli_rpc_pipe_open(cli, pipe_idx, perr);
2257         if (result == NULL) {
2258                 return NULL;
2259         }
2260
2261         result->domain = talloc_strdup(result, cli->domain);
2262         result->user_name = talloc_strdup(result, cli->user_name);
2263
2264         if ((result->domain == NULL) || (result->user_name == NULL)) {
2265                 *perr = NT_STATUS_NO_MEMORY;
2266                 cli_rpc_pipe_close(result);
2267                 return NULL;
2268         }
2269
2270         *perr = rpc_pipe_bind(result, PIPE_AUTH_TYPE_NONE, PIPE_AUTH_LEVEL_NONE);
2271         if (!NT_STATUS_IS_OK(*perr)) {
2272                 int lvl = 0;
2273                 if (pipe_idx == PI_DSSETUP) {
2274                         /* non AD domains just don't have this pipe, avoid
2275                          * level 0 statement in that case - gd */
2276                         lvl = 3;
2277                 }
2278                 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe %s failed with error %s\n",
2279                         cli_get_pipe_name(pipe_idx), nt_errstr(*perr) ));
2280                 cli_rpc_pipe_close(result);
2281                 return NULL;
2282         }
2283
2284         DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine %s and bound anonymously.\n",
2285                         result->pipe_name, cli->desthost ));
2286
2287         return result;
2288 }
2289
2290 /****************************************************************************
2291  Free function for NTLMSSP auth.
2292  ****************************************************************************/
2293
2294 static void cli_ntlmssp_auth_free(struct cli_pipe_auth_data *auth)
2295 {
2296         if (auth->a_u.ntlmssp_state) {
2297                 ntlmssp_end(&auth->a_u.ntlmssp_state);
2298                 auth->a_u.ntlmssp_state = NULL;
2299         }
2300 }
2301
2302 /****************************************************************************
2303  Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
2304  ****************************************************************************/
2305
2306 static struct rpc_pipe_client *cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
2307                                                 int pipe_idx,
2308                                                 enum pipe_auth_type auth_type,
2309                                                 enum pipe_auth_level auth_level,
2310                                                 const char *domain,
2311                                                 const char *username,
2312                                                 const char *password,
2313                                                 NTSTATUS *perr)
2314 {
2315         struct rpc_pipe_client *result;
2316         NTLMSSP_STATE *ntlmssp_state = NULL;
2317
2318         result = cli_rpc_pipe_open(cli, pipe_idx, perr);
2319         if (result == NULL) {
2320                 return NULL;
2321         }
2322
2323         result->auth.cli_auth_data_free_func = cli_ntlmssp_auth_free;
2324
2325         result->domain = talloc_strdup(result, domain);
2326         result->user_name = talloc_strdup(result, username);
2327
2328         if ((result->domain == NULL) || (result->user_name == NULL)) {
2329                 *perr = NT_STATUS_NO_MEMORY;
2330                 goto err;
2331         }
2332
2333         pwd_set_cleartext(&result->pwd, password);
2334
2335         *perr = ntlmssp_client_start(&ntlmssp_state);
2336         if (!NT_STATUS_IS_OK(*perr)) {
2337                 goto err;
2338         }
2339
2340         result->auth.a_u.ntlmssp_state = ntlmssp_state;
2341
2342         *perr = ntlmssp_set_username(ntlmssp_state, username);
2343         if (!NT_STATUS_IS_OK(*perr)) {
2344                 goto err;
2345         }
2346
2347         *perr = ntlmssp_set_domain(ntlmssp_state, domain);
2348         if (!NT_STATUS_IS_OK(*perr)) {
2349                 goto err;
2350         }
2351
2352         if (cli->pwd.null_pwd) {
2353                 *perr = ntlmssp_set_password(ntlmssp_state, NULL);
2354                 if (!NT_STATUS_IS_OK(*perr)) {
2355                         goto err;
2356                 }
2357         } else {
2358                 *perr = ntlmssp_set_password(ntlmssp_state, password);
2359                 if (!NT_STATUS_IS_OK(*perr)) {
2360                         goto err;
2361                 }
2362         }
2363
2364         /* Turn off sign+seal to allow selected auth level to turn it back on. */
2365         ntlmssp_state->neg_flags &= ~(NTLMSSP_NEGOTIATE_SIGN|NTLMSSP_NEGOTIATE_SEAL);
2366
2367         if (auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
2368                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
2369         } else if (auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
2370                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN;
2371         }
2372
2373         *perr = rpc_pipe_bind(result, auth_type, auth_level);
2374         if (!NT_STATUS_IS_OK(*perr)) {
2375                 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
2376                         nt_errstr(*perr) ));
2377                 goto err;
2378         }
2379
2380         DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
2381                 "machine %s and bound NTLMSSP as user %s\\%s.\n",
2382                 result->pipe_name, cli->desthost,
2383                 domain, username ));
2384
2385         return result;
2386
2387   err:
2388
2389         cli_rpc_pipe_close(result);
2390         return NULL;
2391 }
2392
2393 /****************************************************************************
2394  External interface.
2395  Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
2396  ****************************************************************************/
2397
2398 struct rpc_pipe_client *cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
2399                                                 int pipe_idx,
2400                                                 enum pipe_auth_level auth_level,
2401                                                 const char *domain,
2402                                                 const char *username,
2403                                                 const char *password,
2404                                                 NTSTATUS *perr)
2405 {
2406         return cli_rpc_pipe_open_ntlmssp_internal(cli,
2407                                                 pipe_idx,
2408                                                 PIPE_AUTH_TYPE_NTLMSSP,
2409                                                 auth_level,
2410                                                 domain,
2411                                                 username,
2412                                                 password,
2413                                                 perr);
2414 }
2415
2416 /****************************************************************************
2417  External interface.
2418  Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
2419  ****************************************************************************/
2420
2421 struct rpc_pipe_client *cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
2422                                                 int pipe_idx,
2423                                                 enum pipe_auth_level auth_level,
2424                                                 const char *domain,
2425                                                 const char *username,
2426                                                 const char *password,
2427                                                 NTSTATUS *perr)
2428 {
2429         return cli_rpc_pipe_open_ntlmssp_internal(cli,
2430                                                 pipe_idx,
2431                                                 PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
2432                                                 auth_level,
2433                                                 domain,
2434                                                 username,
2435                                                 password,
2436                                                 perr);
2437 }
2438
2439 /****************************************************************************
2440   Get a the schannel session key out of an already opened netlogon pipe.
2441  ****************************************************************************/
2442 static bool get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
2443                                             struct cli_state *cli,
2444                                             const char *domain,
2445                                             uint32 *pneg_flags,
2446                                             NTSTATUS *perr)
2447 {
2448         uint32 sec_chan_type = 0;
2449         unsigned char machine_pwd[16];
2450         const char *machine_account;
2451
2452         /* Get the machine account credentials from secrets.tdb. */
2453         if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
2454                                &sec_chan_type))
2455         {
2456                 DEBUG(0, ("get_schannel_session_key: could not fetch "
2457                         "trust account password for domain '%s'\n",
2458                         domain));
2459                 *perr = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2460                 return false;
2461         }
2462
2463         *perr = rpccli_netlogon_setup_creds(netlogon_pipe,
2464                                         cli->desthost, /* server name */
2465                                         domain,        /* domain */
2466                                         global_myname(), /* client name */
2467                                         machine_account, /* machine account name */
2468                                         machine_pwd,
2469                                         sec_chan_type,
2470                                         pneg_flags);
2471
2472         if (!NT_STATUS_IS_OK(*perr)) {
2473                 DEBUG(3,("get_schannel_session_key_common: rpccli_netlogon_setup_creds "
2474                         "failed with result %s to server %s, domain %s, machine account %s.\n",
2475                         nt_errstr(*perr), cli->desthost, domain, machine_account ));
2476                 return false;
2477         }
2478
2479         if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
2480                 DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
2481                         cli->desthost));
2482                 *perr = NT_STATUS_INVALID_NETWORK_RESPONSE;
2483                 return false;
2484         }
2485
2486         return true;
2487 }
2488
2489 /****************************************************************************
2490  Open a netlogon pipe and get the schannel session key.
2491  Now exposed to external callers.
2492  ****************************************************************************/
2493
2494
2495 struct rpc_pipe_client *get_schannel_session_key(struct cli_state *cli,
2496                                                         const char *domain,
2497                                                         uint32 *pneg_flags,
2498                                                         NTSTATUS *perr)
2499 {
2500         struct rpc_pipe_client *netlogon_pipe = NULL;
2501
2502         netlogon_pipe = cli_rpc_pipe_open_noauth(cli, PI_NETLOGON, perr);
2503         if (!netlogon_pipe) {
2504                 return NULL;
2505         }
2506
2507         if (!get_schannel_session_key_common(netlogon_pipe, cli, domain,
2508                                              pneg_flags, perr))
2509         {
2510                 cli_rpc_pipe_close(netlogon_pipe);
2511                 return NULL;
2512         }
2513
2514         return netlogon_pipe;
2515 }
2516
2517 /****************************************************************************
2518  External interface.
2519  Open a named pipe to an SMB server and bind using schannel (bind type 68)
2520  using session_key. sign and seal.
2521  ****************************************************************************/
2522
2523 struct rpc_pipe_client *cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
2524                                         int pipe_idx,
2525                                         enum pipe_auth_level auth_level,
2526                                         const char *domain,
2527                                         const struct dcinfo *pdc,
2528                                         NTSTATUS *perr)
2529 {
2530         struct rpc_pipe_client *result;
2531
2532         result = cli_rpc_pipe_open(cli, pipe_idx, perr);
2533         if (result == NULL) {
2534                 return NULL;
2535         }
2536
2537         result->auth.a_u.schannel_auth = TALLOC_ZERO_P(
2538                 result, struct schannel_auth_struct);
2539         if (!result->auth.a_u.schannel_auth) {
2540                 cli_rpc_pipe_close(result);
2541                 *perr = NT_STATUS_NO_MEMORY;
2542                 return NULL;
2543         }
2544
2545         result->domain = domain;
2546         memcpy(result->auth.a_u.schannel_auth->sess_key, pdc->sess_key, 16);
2547
2548         *perr = rpc_pipe_bind(result, PIPE_AUTH_TYPE_SCHANNEL, auth_level);
2549         if (!NT_STATUS_IS_OK(*perr)) {
2550                 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: cli_rpc_pipe_bind failed with error %s\n",
2551                         nt_errstr(*perr) ));
2552                 cli_rpc_pipe_close(result);
2553                 return NULL;
2554         }
2555
2556         /* The credentials on a new netlogon pipe are the ones we are passed in - copy them over. */
2557         if (result->dc) {
2558                 *result->dc = *pdc;
2559         }
2560
2561         DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
2562                 "for domain %s "
2563                 "and bound using schannel.\n",
2564                 result->pipe_name, cli->desthost, domain ));
2565
2566         return result;
2567 }
2568
2569 /****************************************************************************
2570  Open a named pipe to an SMB server and bind using schannel (bind type 68).
2571  Fetch the session key ourselves using a temporary netlogon pipe. This
2572  version uses an ntlmssp auth bound netlogon pipe to get the key.
2573  ****************************************************************************/
2574
2575 static struct rpc_pipe_client *get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
2576                                                         const char *domain,
2577                                                         const char *username,
2578                                                         const char *password,
2579                                                         uint32 *pneg_flags,
2580                                                         NTSTATUS *perr)
2581 {
2582         struct rpc_pipe_client *netlogon_pipe = NULL;
2583
2584         netlogon_pipe = cli_rpc_pipe_open_spnego_ntlmssp(cli, PI_NETLOGON, PIPE_AUTH_LEVEL_PRIVACY, domain, username, password, perr);
2585         if (!netlogon_pipe) {
2586                 return NULL;
2587         }
2588
2589         if (!get_schannel_session_key_common(netlogon_pipe, cli, domain,
2590                                              pneg_flags, perr))
2591         {
2592                 cli_rpc_pipe_close(netlogon_pipe);
2593                 return NULL;
2594         }
2595
2596         return netlogon_pipe;
2597 }
2598
2599 /****************************************************************************
2600  Open a named pipe to an SMB server and bind using schannel (bind type 68).
2601  Fetch the session key ourselves using a temporary netlogon pipe. This version
2602  uses an ntlmssp bind to get the session key.
2603  ****************************************************************************/
2604
2605 struct rpc_pipe_client *cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
2606                                                 int pipe_idx,
2607                                                 enum pipe_auth_level auth_level,
2608                                                 const char *domain,
2609                                                 const char *username,
2610                                                 const char *password,
2611                                                 NTSTATUS *perr)
2612 {
2613         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
2614         struct rpc_pipe_client *netlogon_pipe = NULL;
2615         struct rpc_pipe_client *result = NULL;
2616
2617         netlogon_pipe = get_schannel_session_key_auth_ntlmssp(cli, domain, username,
2618                                                         password, &neg_flags, perr);
2619         if (!netlogon_pipe) {
2620                 DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
2621                         "key from server %s for domain %s.\n",
2622                         cli->desthost, domain ));
2623                 return NULL;
2624         }
2625
2626         result = cli_rpc_pipe_open_schannel_with_key(cli, pipe_idx,
2627                                 auth_level,
2628                                 domain, netlogon_pipe->dc, perr);
2629
2630         /* Now we've bound using the session key we can close the netlog pipe. */
2631         cli_rpc_pipe_close(netlogon_pipe);
2632
2633         return result;
2634 }
2635
2636 /****************************************************************************
2637  Open a named pipe to an SMB server and bind using schannel (bind type 68).
2638  Fetch the session key ourselves using a temporary netlogon pipe.
2639  ****************************************************************************/
2640
2641 struct rpc_pipe_client *cli_rpc_pipe_open_schannel(struct cli_state *cli,
2642                                                 int pipe_idx,
2643                                                 enum pipe_auth_level auth_level,
2644                                                 const char *domain,
2645                                                 NTSTATUS *perr)
2646 {
2647         uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
2648         struct rpc_pipe_client *netlogon_pipe = NULL;
2649         struct rpc_pipe_client *result = NULL;
2650
2651         netlogon_pipe = get_schannel_session_key(cli, domain, &neg_flags, perr);
2652         if (!netlogon_pipe) {
2653                 DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
2654                         "key from server %s for domain %s.\n",
2655                         cli->desthost, domain ));
2656                 return NULL;
2657         }
2658
2659         result = cli_rpc_pipe_open_schannel_with_key(cli, pipe_idx,
2660                                 auth_level,
2661                                 domain, netlogon_pipe->dc, perr);
2662
2663         /* Now we've bound using the session key we can close the netlog pipe. */
2664         cli_rpc_pipe_close(netlogon_pipe);
2665
2666         return result;
2667 }
2668
2669 #ifdef HAVE_KRB5
2670
2671 /****************************************************************************
2672  Free function for the kerberos spcific data.
2673  ****************************************************************************/
2674
2675 static void kerberos_auth_struct_free(struct cli_pipe_auth_data *a)
2676 {
2677         data_blob_free(&a->a_u.kerberos_auth->session_key);
2678 }
2679
2680 #endif
2681
2682 /****************************************************************************
2683  Open a named pipe to an SMB server and bind using krb5 (bind type 16).
2684  The idea is this can be called with service_princ, username and password all
2685  NULL so long as the caller has a TGT.
2686  ****************************************************************************/
2687
2688 struct rpc_pipe_client *cli_rpc_pipe_open_krb5(struct cli_state *cli,
2689                                                 int pipe_idx,
2690                                                 enum pipe_auth_level auth_level,
2691                                                 const char *service_princ,
2692                                                 const char *username,
2693                                                 const char *password,
2694                                                 NTSTATUS *perr)
2695 {
2696 #ifdef HAVE_KRB5
2697         struct rpc_pipe_client *result;
2698
2699         result = cli_rpc_pipe_open(cli, pipe_idx, perr);
2700         if (result == NULL) {
2701                 return NULL;
2702         }
2703
2704         /* Default service principal is "desthost$@realm" */
2705         if (!service_princ) {
2706                 service_princ = talloc_asprintf(result, "%s$@%s",
2707                                                 cli->desthost, lp_realm() );
2708                 if (!service_princ) {
2709                         cli_rpc_pipe_close(result);
2710                         return NULL;
2711                 }
2712         }
2713
2714         /* Only get a new TGT if username/password are given. */
2715         if (username && password) {
2716                 int ret = kerberos_kinit_password(username, password, 0, NULL);
2717                 if (ret) {
2718                         cli_rpc_pipe_close(result);
2719                         return NULL;
2720                 }
2721         }
2722
2723         result->auth.a_u.kerberos_auth = TALLOC_ZERO_P(
2724                 result, struct kerberos_auth_struct);
2725         if (!result->auth.a_u.kerberos_auth) {
2726                 cli_rpc_pipe_close(result);
2727                 *perr = NT_STATUS_NO_MEMORY;
2728                 return NULL;
2729         }
2730
2731         result->auth.a_u.kerberos_auth->service_principal = service_princ;
2732         result->auth.cli_auth_data_free_func = kerberos_auth_struct_free;
2733
2734         *perr = rpc_pipe_bind(result, PIPE_AUTH_TYPE_KRB5, auth_level);
2735         if (!NT_STATUS_IS_OK(*perr)) {
2736                 DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed with error %s\n",
2737                         nt_errstr(*perr) ));
2738                 cli_rpc_pipe_close(result);
2739                 return NULL;
2740         }
2741
2742         return result;
2743 #else
2744         DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
2745         return NULL;
2746 #endif
2747 }